https://community.splunk.com/t5/Splunk-Dev/Get-total-number-of-columns/m-p/300338#M3860 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/66281">@vinod94</a>, what is your existing chart command that you have used? It is possible that you can have the total_date_columns value calculated in the chart command itself. Also once you get the <CODE>total_date_columns</CODE>, what is the next thing you would want to do?</P> <P>I would also use foreach command. But, here is a run anywhere search with Splunk's _internal index and <CODE>transpose</CODE>, <CODE>addtotals</CODE> and filldown commands. This is just to document an alternative approach:</P> <PRE><CODE>index=_internal sourcetype=splunkd log_level!="INFO" | eval Dates=strftime(_time,"%Y/%m/%d") | chart count over Dates by component useother=f usenull=f | eval total_date_columns=1 | transpose 0 header_field="Dates" column_name="Dates" | addtotals row=t col=f fieldname="total_date_columns" | eval total_date_columns=case(Dates=="total_date_columns",total_date_columns) | reverse | filldown total_date_columns | search Dates!="total_date_columns" | reverse </CODE></PRE> Tue, 29 Sep 2020 18:50:40 GMT niketn 2020-09-29T18:50:40Z https://community.splunk.com/t5/Splunk-Dev/Get-total-number-of-columns/m-p/300336#M3858 <PRE><CODE> assigned 2018-02-06 2018-02-08 2018-02-13 2018-02-15 4 0 0 0 0 9 0 0 0 0 10 1 0 0 0 11 1 0 0 0 </CODE></PRE> <P>where the above date values are present in a field called DATES. I have used chart command to get the above table.<BR /> I want to create a new column which should give me the total number of date columns.Here, I have 4 dates in my column so the output should look like this</P> <PRE><CODE> assigned 2018-02-06 2018-02-08 2018-02-13 2018-02-15 total_date_columns 4 0 0 0 0 4 9 0 0 0 0 4 10 1 0 0 0 4 11 1 0 0 0 4 </CODE></PRE> Mon, 02 Apr 2018 12:20:59 GMT https://community.splunk.com/t5/Splunk-Dev/Get-total-number-of-columns/m-p/300336#M3858 vinod94 2018-04-02T12:20:59Z https://community.splunk.com/t5/Splunk-Dev/Get-total-number-of-columns/m-p/300337#M3859 <P>Assuming the date columns will always take that format, this should work:</P> <PRE><CODE>your base search | eval total_date_columns=0 | foreach 2018* [ total_date_columns=total_date_columns+1 ] </CODE></PRE> Mon, 02 Apr 2018 14:23:51 GMT https://community.splunk.com/t5/Splunk-Dev/Get-total-number-of-columns/m-p/300337#M3859 elliotproebstel 2018-04-02T14:23:51Z https://community.splunk.com/t5/Splunk-Dev/Get-total-number-of-columns/m-p/300338#M3860 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/66281">@vinod94</a>, what is your existing chart command that you have used? It is possible that you can have the total_date_columns value calculated in the chart command itself. Also once you get the <CODE>total_date_columns</CODE>, what is the next thing you would want to do?</P> <P>I would also use foreach command. But, here is a run anywhere search with Splunk's _internal index and <CODE>transpose</CODE>, <CODE>addtotals</CODE> and filldown commands. This is just to document an alternative approach:</P> <PRE><CODE>index=_internal sourcetype=splunkd log_level!="INFO" | eval Dates=strftime(_time,"%Y/%m/%d") | chart count over Dates by component useother=f usenull=f | eval total_date_columns=1 | transpose 0 header_field="Dates" column_name="Dates" | addtotals row=t col=f fieldname="total_date_columns" | eval total_date_columns=case(Dates=="total_date_columns",total_date_columns) | reverse | filldown total_date_columns | search Dates!="total_date_columns" | reverse </CODE></PRE> Tue, 29 Sep 2020 18:50:40 GMT https://community.splunk.com/t5/Splunk-Dev/Get-total-number-of-columns/m-p/300338#M3860 niketn 2020-09-29T18:50:40Z https://community.splunk.com/t5/Splunk-Dev/Get-total-number-of-columns/m-p/300339#M3861 <P>Thanks, it worked!</P> Tue, 03 Apr 2018 06:00:28 GMT https://community.splunk.com/t5/Splunk-Dev/Get-total-number-of-columns/m-p/300339#M3861 vinod94 2018-04-03T06:00:28Z