Splunk Enterprise

Custom table view

vishwa
Path Finder

i have a query where my results looks like this

Application1-StartApplication1-StopApplication2-StartApplication2-StopApplication3-StartApplication3-Stop
1041277030
12810432
1441251612


But i want to see the output as shown below is that possible???

StartStartStartStopStopStop
Application1Application2Application3Application1Application2Application3
1012704730
12103842
1412164512
Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can't do exactly that with a 2 line header, but depending on your SPL, yes, it's possible. I'm guessing you have those resuts from a chart or stats command. The columns are 'sorted', so all you need to do is make your column names

Start-ApplicationX and Stop-ApplicationX 

so the starts come before the stops

or you can just take your existing table and use the table command to do

| table *Start *Stop

vishwa
Path Finder

hank you it worked.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...