Reporting

Pivot Boolean Lables

Path Finder

I'm working with splunk6, data models and pivot tables. When I use the GUI function to relabel "True" and "False" to something more meaningful it doesn't actually display the labels.

Has anyone gotten the labels to actually show up in a pivot?

Tags (1)
0 Karma

Path Finder

Eh.. nothing fancy.

I have a boolean field called "is_anonymous" to determine if the user is authenticated to the proxy or anonymously browsing.

in the table, I split the column "is_anonymous" and relabeled "true == anonymous" and "false == authenticated" but the table still shows true/false as the table column headers, rather than using the labels.

-l

0 Karma

Splunk Employee
Splunk Employee

They work for me. Can you describe how you set up the field in your data model? And exactly what you're trying to do in pivot?

0 Karma

Splunk Employee
Splunk Employee

And how are you extracting the boolean attribute? I think it has to have a value of either the string "true" or the string "false". In my case I'm using an Eval and the expression looks like this:

if(sourcetype == "foo", "true", "false")

0 Karma

Path Finder

Eh.. nothing fancy.

I have a boolean field called "is_anonymous" to determine if the user is authenticated to the proxy or anonymously browsing.

in the table, I split the column "is_anonymous" and relabeled "true == anonymous" and "false == authenticated" but the table still shows true/false as the table column headers, rather than using the labels.

-l

0 Karma