Getting Data In

Can i control the name of the column headers in a timechart using the by

HattrickNZ
Motivator

I have a search

...| timechart span=1h sum(kpi1) as Name1 by LABEL

This gives a 2 column output with _time and LABEL1 as there headers.

How Can I control the value LABEL1 of the header for the colum to be something else?

I have tried doing ...| strcat LABEL "-ALT" LABEL_ALT | timechart span=1h sum(kpi1) as Name1 by LABEL_ALT but this seem to divide the values in the `LABEL1 by 2 which is not what I want, maybe it is something to do with the data format.

0 Karma
1 Solution

HattrickNZ
Motivator

this works, if LABEL1 is the column header

...| timechart span=1h sum(kpi1) as Name1 by LABEL | rename LABEL1 as test123

View solution in original post

0 Karma

HattrickNZ
Motivator

this works, if LABEL1 is the column header

...| timechart span=1h sum(kpi1) as Name1 by LABEL | rename LABEL1 as test123

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...