Splunk Enterprise

how to change the fields in the dashboard for splunk

ddp2kor
Loves-to-Learn

changing fields in dashboards.PNG

Hi,

 

In this dashboard ,i want the changing fields and coloumn.

For example I want the " planned_AB_ECD1" Beside to  "Time spent in Hrs_AE_ECD1 ".pleas

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| transpose 0
| eval column=case(column="planned_AB_ECD1","AB_ECD1_A_planned",column="Time spent in Hrs_AB_ECD1","AB_ECD1_B_Hrs_AB_ECD1",true(),column)
| sort column
| eval column=case(column="AB_ECD1_A_planned","planned_AB_ECD1",column="AB_ECD1_B_Hrs_AB_ECD1","Time spent in Hrs_AB_ECD1",true(),column)
| transpose 0 header_field=column
| fields - column
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @ITWhisperer ..By reordering the fields on table/fields command, can not we re arrange this requirement?!?!

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

@inventsekar  There are many ways to skin a cat!

If you know all the field / column names upfront, using table is one way to go.

If the column names are dependent on the data returned by the search (and these column names look like they might be), using transpose and re-evaluating the column names before sorting and re-evaluating back again provides opportunities to potentially use a more generic renaming scheme. Admittedly, if the column names are known and static, transpose is like using a sledgehammer to crack a nut.

inventsekar
SplunkTrust
SplunkTrust

Hi @ddp2kor may we know your current search query please, so that we can suggest easily.. the statistics table is created generally by "table" or "fields" command. 

on these table/fields command, we can just "re-arrange" the order, thats it. 

by seeing your screenshot, i assume, your search query is approximately:

Your current search query - 
base search | <some search queries> | table(or Fields) EMPName IT Planned_AB_ECD1 .....source sourcetype spl

modified version:
base search | <some search queries> | table(or Fields) EMPName IT "Planned_AB_ECD1" "Time spent in Hrs_AE_ECD1" .....source sourcetype spl

 

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...