topic Re: How can I change the header so it displays the current date? in Splunk Search

How can I change the header so it displays the current date?

sbbadri — Thu, 10 Aug 2017 19:58:52 GMT

Hi,

I have a table output like below,

**OS**       Range1       Range2       Range3     Range4
AIX          10           20           30         40
HP-UX        50           60           70         80
Linux        90           100          110        120

But I want a table like below,

**2017-08-10** Range1       Range2       Range3   Range4
AIX            10           20           30       40
HP-UX          50           60           70       80
Linux          90           100          110      120

Date should be change daily.

Re: How can I change the header so it displays the current date?

somesoni2 — Thu, 10 Aug 2017 20:14:13 GMT

Try this

your current search giving fields OS Range 1... (gives output 1)
| eval today=strftime(now(),"%Y-%m-%d") 
| eval {today}=OS | fields - OS today

Re: How can I change the header so it displays the current date?

sbbadri — Thu, 10 Aug 2017 20:36:01 GMT

Nope it is not working. i need header label instead of os i need current date value.

Re: How can I change the header so it displays the current date?

somesoni2 — Thu, 10 Aug 2017 20:44:53 GMT

Can you provide what you get with my answer and what you expect?

Runanywhere sample.

| gentimes start=-1 | eval OS="AIX" | table OS | eval Range1=30 | eval Range2=50

Output

OS    Range1   Range2
AIX  30  50

With my answer

| gentimes start=-1 | eval OS="AIX" | table OS | eval Range1=30 | eval Range2=50  | eval today=strftime(now(),"%Y-%m-%d") 
| eval {today}=OS | fields - today OS

Output

2017-08-10   Range1   Range2
AIX  30  50

Re: How can I change the header so it displays the current date?

sbbadri — Tue, 29 Sep 2020 15:19:59 GMT

Query:

| inputlookup SystemsUpTimeRange.csv WHERE (range="91-180 days") AND os=AIX AND os!=NA
| stats sum(count) as tcount by _time os range
| sort - _time
| head 8
| rename tcount as 91_180_days
| fields - range
| delta 91_180_days as 91_180_days_c p=7
| tail 1 | ..... more query ............ | eval today=strftime(now(),"%Y-%m-%d")
| eval {today}=os | fields - os today | table 91_180_days 91_180_days_c 180_plus_days 180_plus_days_c

Ouput:

91_180_days 91_180_days_c 180_plus_days 180_plus_days_c
25 7 77 -6
6 0
456 -20 142 -9

Re: How can I change the header so it displays the current date?

somesoni2 — Thu, 10 Aug 2017 21:11:39 GMT

Your last table command is removing the field with today's date. Replace your last table command with this

| table * 91_180_days 91_180_days_c 180_plus_days 180_plus_days_c

| table 2* 91_180_days 91_180_days_c 180_plus_days 180_plus_days_c