Splunk Search

Adding an second identical column and field to Splunk table

dxw350
Path Finder

In order to coincide with an excel spreadsheet, I was hoping that Splunk table can provide two columns that our identical but listed with data at the beginning and the middle of the table sheet. Is there a way to have the same field name column more than once?

Tags (3)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Heh.

Two answers in one: No, it can't but you can make humans think it did.

The run anywhere sample code looks like this ...

 | makeresults 
 | eval george = "first one" 
 | eval frank = "second one" 
 | rename frank as " george" 
 | table _time george " george"

... with the resulting output...

 _time                george      george 
 2017-06-18 23:07:44  first one  second one  

You can also just change the capitalization rather than including invisible spaces in the field name. Humans will disregard the difference.

0 Karma

cmerriman
Super Champion

I don't believe you can have the same field name. The closest you could do is different capitalization or adding a special character to it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...