Splunk Enterprise

Custom table view

vishwa
Path Finder

i have a query where my results looks like this

Application1-StartApplication1-StopApplication2-StartApplication2-StopApplication3-StartApplication3-Stop
1041277030
12810432
1441251612


But i want to see the output as shown below is that possible???

StartStartStartStopStopStop
Application1Application2Application3Application1Application2Application3
1012704730
12103842
1412164512
Labels (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can't do exactly that with a 2 line header, but depending on your SPL, yes, it's possible. I'm guessing you have those resuts from a chart or stats command. The columns are 'sorted', so all you need to do is make your column names

Start-ApplicationX and Stop-ApplicationX 

so the starts come before the stops

or you can just take your existing table and use the table command to do

| table *Start *Stop

vishwa
Path Finder

hank you it worked.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...