Getting Data In

Can i control the name of the column headers in a timechart using the by

HattrickNZ
Motivator

I have a search

...| timechart span=1h sum(kpi1) as Name1 by LABEL

This gives a 2 column output with _time and LABEL1 as there headers.

How Can I control the value LABEL1 of the header for the colum to be something else?

I have tried doing ...| strcat LABEL "-ALT" LABEL_ALT | timechart span=1h sum(kpi1) as Name1 by LABEL_ALT but this seem to divide the values in the `LABEL1 by 2 which is not what I want, maybe it is something to do with the data format.

0 Karma
1 Solution

HattrickNZ
Motivator

this works, if LABEL1 is the column header

...| timechart span=1h sum(kpi1) as Name1 by LABEL | rename LABEL1 as test123

View solution in original post

0 Karma

HattrickNZ
Motivator

this works, if LABEL1 is the column header

...| timechart span=1h sum(kpi1) as Name1 by LABEL | rename LABEL1 as test123

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...