Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Table Column Headings
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am doing a search based on a pulldown values and displaying the results in a table. Here is the sample search
stats count(eval(val1)), count(eval(val2)) BY $viewby$, itemType | table $viewby$, "Item Type"
(where viewby is selected value from dropdown. Now the applicable values for viewby in the drop down are "type1", "type2", "type3". In the column header, I want to display "Type 1" for "type1". How can i do that. It is currently displaying "type1" as column header. rename command is not working as well. Appreciate your input.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sriramvaidhyanathan,
You could pipe to the rename command at the end of the search(Splunk docs here), for example:
<your_search>| rename type1 AS "Type 1",type2 AS "Type 2"
As can be seen above, you can do this multiple times with one "rename" command... simply seperate with a comma (i.e. ",")
Hope this helps,
MHibbin
P.s. if this answers your question, please mark the answer as accepted/upvote the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sriramvaidhyanathan,
You could pipe to the rename command at the end of the search(Splunk docs here), for example:
<your_search>| rename type1 AS "Type 1",type2 AS "Type 2"
As can be seen above, you can do this multiple times with one "rename" command... simply seperate with a comma (i.e. ",")
Hope this helps,
MHibbin
P.s. if this answers your question, please mark the answer as accepted/upvote the answer.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I was doing rename prior to the table. Something like this. stats count(eval(val1)), count(eval(val2)) BY $viewby$, itemType | rename $viewby$ AS ....| table ..... Changed rename to pipe at the end. Works fine now. Thanks for the help !
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...
Event Series: Mastering AI Tokenomics and Splunk Agent Observability
span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services
