topic Re: [Splunk + R] How do I dynamically rename the column name of results obtained from running an R script on a splunk query? in Dashboards & Visualizations

[Splunk + R] How do I dynamically rename the column name of results obtained from running an R script on a splunk query?

m_vivek — Mon, 12 Oct 2015 19:46:32 GMT

I have a splunk + R query :

index=abcd host=pqrs*   earliest=07/01/2015:00:0:0 latest=07/02/2015:01:0:0 | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR) by TYPE | eval dataset=1 | append[index=abcd host=pqrs*   earliest=07/03/2015:00:0:0 latest=07/04/2015:01:0:0 | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR) by TYPE  | eval dataset=2] | r "   data= input 
.
.
.
output =  my_output"

the output looks like this :

Q.1
This kind of output is looked at every two weeks. How do I rename the columns so that they also display a proper name along with the date range chosen in the query in Splunk?
Ex: I want the Count.Pre column to look like Count 07/01 to 07/02 ,
and Count.post as Count 07/03 to 07/04 and similarly for the other columns whose results are dependent on the date.
(I know renaming columns can be done it in multiple ways using R)

Q.2 How do I do it dynamically? i.e if the date range in the query is changed the names of the columns in the results should also reflect the same change mentioned above.

Re: [Splunk + R] How do I dynamically rename the column name of results obtained from running an R script on a splunk query?

martin_mueller — Mon, 12 Oct 2015 19:51:43 GMT

Here's a run-anywhere non-R example:

| stats count as Median.Pre | addinfo | eval dynamic_part = strftime(info_min_time, "%m/%d")." to ".strftime(info_max_time, "%m/%d") | eval Median {dynamic_part} = 'Median.Pre' | fields - info_* Median.Pre dynamic_part

Re: [Splunk + R] How do I dynamically rename the column name of results obtained from running an R script on a splunk query?

m_vivek — Mon, 12 Oct 2015 21:00:13 GMT

@martin_mueller thanks.
Doing the above is changing the name dynamically but it is displaying only that specific column with only one value. how to display the results in my screen shot 'as is' but only with a change of column name?

Re: [Splunk + R] How do I dynamically rename the column name of results obtained from running an R script on a splunk query?

martin_mueller — Mon, 12 Oct 2015 21:25:18 GMT

The entire search I posted is a standalone dummy example. Paste it into an empty search bar and see what it does to the generated field, then adapt to your actual query.