In order to coincide with an excel spreadsheet, I was hoping that Splunk table can provide two columns that our identical but listed with data at the beginning and the middle of the table sheet. Is there a way to have the same field name column more than once?
Heh.
Two answers in one: No, it can't but you can make humans think it did.
The run anywhere sample code looks like this ...
| makeresults
| eval george = "first one"
| eval frank = "second one"
| rename frank as " george"
| table _time george " george"
... with the resulting output...
_time george george
2017-06-18 23:07:44 first one second one
You can also just change the capitalization rather than including invisible spaces in the field name. Humans will disregard the difference.
I don't believe you can have the same field name. The closest you could do is different capitalization or adding a special character to it.