Getting Data In

Can i control the name of the column headers in a timechart using the by

HattrickNZ
Motivator

I have a search

...| timechart span=1h sum(kpi1) as Name1 by LABEL

This gives a 2 column output with _time and LABEL1 as there headers.

How Can I control the value LABEL1 of the header for the colum to be something else?

I have tried doing ...| strcat LABEL "-ALT" LABEL_ALT | timechart span=1h sum(kpi1) as Name1 by LABEL_ALT but this seem to divide the values in the `LABEL1 by 2 which is not what I want, maybe it is something to do with the data format.

0 Karma
1 Solution

HattrickNZ
Motivator

this works, if LABEL1 is the column header

...| timechart span=1h sum(kpi1) as Name1 by LABEL | rename LABEL1 as test123

View solution in original post

0 Karma

HattrickNZ
Motivator

this works, if LABEL1 is the column header

...| timechart span=1h sum(kpi1) as Name1 by LABEL | rename LABEL1 as test123

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...