Reporting

Pivot Boolean Lables

ltawfall
Path Finder

I'm working with splunk6, data models and pivot tables. When I use the GUI function to relabel "True" and "False" to something more meaningful it doesn't actually display the labels.

Has anyone gotten the labels to actually show up in a pivot?

Tags (1)
0 Karma

ltawfall
Path Finder

Eh.. nothing fancy.

I have a boolean field called "is_anonymous" to determine if the user is authenticated to the proxy or anonymously browsing.

in the table, I split the column "is_anonymous" and relabeled "true == anonymous" and "false == authenticated" but the table still shows true/false as the table column headers, rather than using the labels.

-l

0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

They work for me. Can you describe how you set up the field in your data model? And exactly what you're trying to do in pivot?

0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

And how are you extracting the boolean attribute? I think it has to have a value of either the string "true" or the string "false". In my case I'm using an Eval and the expression looks like this:

if(sourcetype == "foo", "true", "false")

0 Karma

ltawfall
Path Finder

Eh.. nothing fancy.

I have a boolean field called "is_anonymous" to determine if the user is authenticated to the proxy or anonymously browsing.

in the table, I split the column "is_anonymous" and relabeled "true == anonymous" and "false == authenticated" but the table still shows true/false as the table column headers, rather than using the labels.

-l

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!