Hi,
How do I go about creating a subheading in splunk. My table is in the following format:
Date1 Date2
ITEM | DIFF | DIFF2 | DIFF | DIFF2
Essentially, I have data for DIFF and DIFF2 for day 1, and then the same for day2.
Currently, It's like this:
ITEM| DIFF | DIFF2 | DIFF | DIFF2 | Date
04/12/2017
04/12/2017
04/12/2017
04/12/2017
04/12/2017
04/12/2017
04/12/2017
04/12/2017
04/12/2017
04/12/2017
Can someone help me with this please or direct me to an alternative solution to this problem?
Thanks
Edit your post and reformat the text so that the alignment is correct and maybe we can understand what you need.
Splunk doesn't support sub heading/2nd row column in headers. One thing you can try will be to add the date into the column names so that you can differentiate the columns by date. Like this (the regular expression on rex command was truncated, make sure you select Splunk query and press Ctrl+K to format the code next time).
source=* host="xxx" sourcetype="csv" | rex field=source "(?:[^_]_){2}(?.*).txt"| chart list(ITEM) as items list(SOH_DIFF) as soh_diff list(UNAVAILABLE_QTY_DIFF) as uqd by sourcetype date |table* items, *soh_diff,*uqd
Thank you! It worked
@mahbs, please accept the answer to mark this question as answered.
@mahbs, can you add screenshot for expected output and also your current query?
I'm not able to because I don't have enough points. This is my current query:
source=* host="xxx" sourcetype="csv" | rex field=source "(?:[^_]_){2}(?
The output is numerical values.