Splunk Search

how to rename column name based on condition

Path Finder

Hi all,

I want to name the column name based on condition as below snapshot, for example, if Q1=A, then rename row 1 as text1, if Q2 is B then rename row is text 2.

Do you guys know how to achieve this?


Tags (3)
0 Karma


Do you use the transpose command like following?

index=_internal | stats count by sourcetype | transpose 7

alt text

you can use eval command and chart command instead of using the transpose command
try this search

index=_internal | stats count by sourcetype 
| eval a=if(sourcetype="mongod","test1",a) 
| eval a=if(sourcetype="scheduler","test2",a) 
| eval a=if(sourcetype="splunk_web_access","test3",a) 
| eval a=if(sourcetype="splunk_web_service","test4",a)
| eval a=if(sourcetype="splunkd","test5",a) 
| eval a=if(sourcetype="splunkd_access","test6",a) 
| eval a=if(sourcetype="splunkd_ui_access","test7",a)  
| eval column="percent"
| chart values(count) by column,a

alt text

0 Karma

Path Finder

sorry if Q0=A, then column name = text1, if Q0= B then column name = text2. Since I have sort the Q0, so the order of A B C D E would be change automatically, that is why I need use Q0 as a condition to rename column name.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...