how to change the fields in the dashboard for splunk

[ddp2kor]

Hi,

In this dashboard ,i want the changing fields and coloumn.

For example I want the " planned_AB_ECD1" Beside to  "Time spent in Hrs_AE_ECD1 ".pleas

[ITWhisperer]

| transpose 0
| eval column=case(column="planned_AB_ECD1","AB_ECD1_A_planned",column="Time spent in Hrs_AB_ECD1","AB_ECD1_B_Hrs_AB_ECD1",true(),column)
| sort column
| eval column=case(column="AB_ECD1_A_planned","planned_AB_ECD1",column="AB_ECD1_B_Hrs_AB_ECD1","Time spent in Hrs_AB_ECD1",true(),column)
| transpose 0 header_field=column
| fields - column

[inventsekar]

Hi @ITWhisperer ..By reordering the fields on table/fields command, can not we re arrange this requirement?!?!

[ITWhisperer]

@inventsekar  There are many ways to skin a cat!

If you know all the field / column names upfront, using table is one way to go.

If the column names are dependent on the data returned by the search (and these column names look like they might be), using transpose and re-evaluating the column names before sorting and re-evaluating back again provides opportunities to potentially use a more generic renaming scheme. Admittedly, if the column names are known and static, transpose is like using a sledgehammer to crack a nut.

[inventsekar]

Hi @ddp2kor may we know your current search query please, so that we can suggest easily.. the statistics table is created generally by "table" or "fields" command. 

on these table/fields command, we can just "re-arrange" the order, thats it. 

by seeing your screenshot, i assume, your search query is approximately:

Your current search query - 
base search | <some search queries> | table(or Fields) EMPName IT Planned_AB_ECD1 .....source sourcetype spl

modified version:
base search | <some search queries> | table(or Fields) EMPName IT "Planned_AB_ECD1" "Time spent in Hrs_AE_ECD1" .....source sourcetype spl