Reporting

Pivot Boolean Lables

ltawfall
Path Finder

I'm working with splunk6, data models and pivot tables. When I use the GUI function to relabel "True" and "False" to something more meaningful it doesn't actually display the labels.

Has anyone gotten the labels to actually show up in a pivot?

Tags (1)
0 Karma

ltawfall
Path Finder

Eh.. nothing fancy.

I have a boolean field called "is_anonymous" to determine if the user is authenticated to the proxy or anonymously browsing.

in the table, I split the column "is_anonymous" and relabeled "true == anonymous" and "false == authenticated" but the table still shows true/false as the table column headers, rather than using the labels.

-l

0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

They work for me. Can you describe how you set up the field in your data model? And exactly what you're trying to do in pivot?

0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

And how are you extracting the boolean attribute? I think it has to have a value of either the string "true" or the string "false". In my case I'm using an Eval and the expression looks like this:

if(sourcetype == "foo", "true", "false")

0 Karma

ltawfall
Path Finder

Eh.. nothing fancy.

I have a boolean field called "is_anonymous" to determine if the user is authenticated to the proxy or anonymously browsing.

in the table, I split the column "is_anonymous" and relabeled "true == anonymous" and "false == authenticated" but the table still shows true/false as the table column headers, rather than using the labels.

-l

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...