Splunk Search

how to rename column name based on condition

hqw
Path Finder

Hi all,

I want to name the column name based on condition as below snapshot, for example, if Q1=A, then rename row 1 as text1, if Q2 is B then rename row is text 2.

Do you guys know how to achieve this?

Thanks

Tags (3)
0 Karma

akanno
Communicator

Do you use the transpose command like following?

index=_internal | stats count by sourcetype | transpose 7

alt text

you can use eval command and chart command instead of using the transpose command
try this search

index=_internal | stats count by sourcetype 
| eval a=if(sourcetype="mongod","test1",a) 
| eval a=if(sourcetype="scheduler","test2",a) 
| eval a=if(sourcetype="splunk_web_access","test3",a) 
| eval a=if(sourcetype="splunk_web_service","test4",a)
| eval a=if(sourcetype="splunkd","test5",a) 
| eval a=if(sourcetype="splunkd_access","test6",a) 
| eval a=if(sourcetype="splunkd_ui_access","test7",a)  
| eval column="percent"
| chart values(count) by column,a

alt text

0 Karma

hqw
Path Finder

sorry if Q0=A, then column name = text1, if Q0= B then column name = text2. Since I have sort the Q0, so the order of A B C D E would be change automatically, that is why I need use Q0 as a condition to rename column name.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...