CODEWITHSUNDEEP
data-visualizationsplunk
Sean Duggan
Sean Duggan

Reputation: 1135

Remove one column name in Splunk chart

I'm receiving data involving the status of various prefixed servers, something like the following:

twserv1: UP
twserv2: UP
poserv1: DOWN
poserv2: UNKNOWN

I want to display this data in a table separated by the prefix and server name like the following:

              TW        PO
serv1         UP        DOWN
serv2         UP        UNKNOWN

I've got this mostly working with the following command courtesy of this Q&A:

| inputlookup serverStatus
| table twserv* poserv*
| eval temp=1
| untable temp key value
| rex field=key "(?<x>tw|po)(?<y>\w+\d+)"
| chart values(value) over y by x
| rename tw as TW po as PO

This yields something like the following:

y             TW        PO
serv1         UP        DOWN
serv2         UP        UNKNOWN

Is there any way to remove just that first column title? I've tried setting it to whitespace, but to no avail.

Upvotes: 1

Views: 672

Answers (1)

warren
warren

Reputation: 33453

That column "title" is really a field name (in this case, "y")

Field names cannot be just whitespace ... because then they "don't exist"

Upvotes: 1

Related Questions