Splunk Search

how to rename column name based on condition

hqw
Path Finder

Hi all,

I want to name the column name based on condition as below snapshot, for example, if Q1=A, then rename row 1 as text1, if Q2 is B then rename row is text 2.

Do you guys know how to achieve this?

Thanks

Tags (3)
0 Karma

akanno
Communicator

Do you use the transpose command like following?

index=_internal | stats count by sourcetype | transpose 7

alt text

you can use eval command and chart command instead of using the transpose command
try this search

index=_internal | stats count by sourcetype 
| eval a=if(sourcetype="mongod","test1",a) 
| eval a=if(sourcetype="scheduler","test2",a) 
| eval a=if(sourcetype="splunk_web_access","test3",a) 
| eval a=if(sourcetype="splunk_web_service","test4",a)
| eval a=if(sourcetype="splunkd","test5",a) 
| eval a=if(sourcetype="splunkd_access","test6",a) 
| eval a=if(sourcetype="splunkd_ui_access","test7",a)  
| eval column="percent"
| chart values(count) by column,a

alt text

0 Karma

hqw
Path Finder

sorry if Q0=A, then column name = text1, if Q0= B then column name = text2. Since I have sort the Q0, so the order of A B C D E would be change automatically, that is why I need use Q0 as a condition to rename column name.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>