Reporting

Pivot Boolean Lables

ltawfall
Path Finder

I'm working with splunk6, data models and pivot tables. When I use the GUI function to relabel "True" and "False" to something more meaningful it doesn't actually display the labels.

Has anyone gotten the labels to actually show up in a pivot?

Tags (1)
0 Karma

ltawfall
Path Finder

Eh.. nothing fancy.

I have a boolean field called "is_anonymous" to determine if the user is authenticated to the proxy or anonymously browsing.

in the table, I split the column "is_anonymous" and relabeled "true == anonymous" and "false == authenticated" but the table still shows true/false as the table column headers, rather than using the labels.

-l

0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

They work for me. Can you describe how you set up the field in your data model? And exactly what you're trying to do in pivot?

0 Karma

Simon_Fishel
Splunk Employee
Splunk Employee

And how are you extracting the boolean attribute? I think it has to have a value of either the string "true" or the string "false". In my case I'm using an Eval and the expression looks like this:

if(sourcetype == "foo", "true", "false")

0 Karma

ltawfall
Path Finder

Eh.. nothing fancy.

I have a boolean field called "is_anonymous" to determine if the user is authenticated to the proxy or anonymously browsing.

in the table, I split the column "is_anonymous" and relabeled "true == anonymous" and "false == authenticated" but the table still shows true/false as the table column headers, rather than using the labels.

-l

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...