Splunk Search

how to rename column name based on condition

Path Finder

Hi all,

I want to name the column name based on condition as below snapshot, for example, if Q1=A, then rename row 1 as text1, if Q2 is B then rename row is text 2.

Do you guys know how to achieve this?


Tags (3)
0 Karma


Do you use the transpose command like following?

index=_internal | stats count by sourcetype | transpose 7

alt text

you can use eval command and chart command instead of using the transpose command
try this search

index=_internal | stats count by sourcetype 
| eval a=if(sourcetype="mongod","test1",a) 
| eval a=if(sourcetype="scheduler","test2",a) 
| eval a=if(sourcetype="splunk_web_access","test3",a) 
| eval a=if(sourcetype="splunk_web_service","test4",a)
| eval a=if(sourcetype="splunkd","test5",a) 
| eval a=if(sourcetype="splunkd_access","test6",a) 
| eval a=if(sourcetype="splunkd_ui_access","test7",a)  
| eval column="percent"
| chart values(count) by column,a

alt text

0 Karma

Path Finder

sorry if Q0=A, then column name = text1, if Q0= B then column name = text2. Since I have sort the Q0, so the order of A B C D E would be change automatically, that is why I need use Q0 as a condition to rename column name.

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...