Getting Data In

Can i control the name of the column headers in a timechart using the by

HattrickNZ
Motivator

I have a search

...| timechart span=1h sum(kpi1) as Name1 by LABEL

This gives a 2 column output with _time and LABEL1 as there headers.

How Can I control the value LABEL1 of the header for the colum to be something else?

I have tried doing ...| strcat LABEL "-ALT" LABEL_ALT | timechart span=1h sum(kpi1) as Name1 by LABEL_ALT but this seem to divide the values in the `LABEL1 by 2 which is not what I want, maybe it is something to do with the data format.

0 Karma
1 Solution

HattrickNZ
Motivator

this works, if LABEL1 is the column header

...| timechart span=1h sum(kpi1) as Name1 by LABEL | rename LABEL1 as test123

View solution in original post

0 Karma

HattrickNZ
Motivator

this works, if LABEL1 is the column header

...| timechart span=1h sum(kpi1) as Name1 by LABEL | rename LABEL1 as test123

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...