topic Re: How do I make a field value as a column heading? in Splunk Search

How do I make a field value as a column heading?

ibob0304 — Fri, 28 Sep 2018 14:38:39 GMT

I would like to display weekday in the column heading.

|Search....
| eval weekday=strftime(now(),"%A")

Output

S.no    | Daily          | weekday
  1        101             Thursday
  2        210             Thursday

Desired Output

S.no    | Daily (Thursday)
  1        101             
  2        210

Tried xyseries and transpose but I couldn't find a way to flip only one column instead of the whole table.

Vijeta — Fri, 28 Sep 2018 15:11:16 GMT

you can use this in your first search, you can replace sno column name by Daily as per your query.

eval weekday=strftime(now(),"%A")|eval column_name=sno| eval sno ( {weekday} )= sno

renjith_nair — Fri, 28 Sep 2018 15:13:40 GMT

@ibob0304,

This works for me,

|Search....
|eval weekday=strftime(now(),"%A")|eval Daily({weekday})=Daily|fields - Daily,weekday

harishalipaka — Fri, 28 Sep 2018 15:18:10 GMT

@ibob

| makeresults |eval weekday=strftime(now(),"%A") |eval value=100 |fields - _time | transpose header_field="weekday"