Splunk Search

Rename a Column?

Path Finder

I'm processing some IIS log files with a search:
stats count max(time_taken) avg(time_taken) as avgTT by cs_uri_stem | fieldformat avgTT=round(avgTT/1000,2) |rename avgTT as "Avg Response Time"

But the result displays a column for both "Avg Response Time" (which seems to lack the rounding I just did) and ALSO displays an (empty) column named avgTT.

How do I do a search and then simply change the text of the column title?

1 Solution

SplunkTrust
SplunkTrust

Try this

your base search | stats count max(time_taken)  avg(time_taken) as avgTT by cs_uri_stem | eval avgTT=round(avgTT/1000,2) |rename avgTT as "Avg Response Time"

View solution in original post

SplunkTrust
SplunkTrust

Try this

your base search | stats count max(time_taken)  avg(time_taken) as avgTT by cs_uri_stem | eval avgTT=round(avgTT/1000,2) |rename avgTT as "Avg Response Time"

View solution in original post

Path Finder

Thank you! This works. For some reason "eval" works when "fieldformat" doesn't. Doesn't make any logical sense to me but thank you very much for providing a working solution!

0 Karma