Rename columns in Sideview SimpleResultsTable and set order

[jchampagne]

I'm having an issue renaming column headers with the SimpleResultsTable in Sideview Utils. If I use a PostProcess module and add:
| rename _time as "Time", src_user as "User", Client_Friendly_Name as "Access Point"

I can then push that to my table and see the columns. However, they aren't in the order I want. If I specify the order in the "fields" parameter of the SimpleResultsTable module, only the columns without spaces in the names are displayed...even if I use quotes.

How can I rename the column headers (fields) and choose the order I want them displayed in?

[sideview]

Note that although Sideview Utils does patch and extend a lot of functonality in SimpleResultsTable, it isn't a Sideview module. The "fields" param specifically doesn't actually try and control the field order.

And when it comes to using the fields clause, that should work. If you're having problems with the spaces in field names, it's a new one on me. Obviously my first thought was to make sure you're quoting the field names with the spaces, but you've already tried that.

One workaround you've probably thought of already is to use the fields or table command to reorder the fields, and then rename them after they've been reordered.

I'm working on the new Table module this week (likely release next week), and among many improved features, it's "fields" param actually will have a direct effect on field order. It also has a "hiddenFields" param that you can use to hide values that are needed for drilldowns, but useless to the user, and it has some pretty cool templating abilities that for all their power, don't actually require the use of any custom code.

Also Table has the ability to add a custom CSS class and/or style to each table row using one or more values from the row's fields, and more.

So everything from clickable links in tablecells, to icons, to complex HTML formatting, to sparklines, and beyond.... Stay tuned there.

UPDATE: as promised, the Sideview Table module has been released. It's "fields" param does have an effect on field order, and it does have that "hiddenFields" param that I mentioned, all the other stuff I referred to... Check out Sideview Utils 2.2.2, remember that current Sideview Utils is ONLY available from the Sideview site, so if you look only Splunkbase you'll only find a very old 1.3.X version.

[sideview]

I see. You essentially want to be able to do <param name="fields">field3 field1 field4 *`, as you would do with the fields command.

Incidentally, you can easily do this with the fields command. Just use it in a postprocess instead of the fields param.

<module name="PostProcess">
<param name="search">field3 field1 field4 *</param>
<module name="Table"/>
</module>

[sbsbb]

In fact, it would be nice to have a parameter field order, where you could specify in which order to display the most important field, and the table module should then display other fields (that are not hidden) after it...

Example :
$result[0].Fields(that would be or nice ;)= field1 field2 field3 field4 field5 field6

table_field_order = field3 field1 field4

targeted output from table: field3 field1 field4 field2 field5 field6