topic Re: How should I rename a dynamic value after using the timechart count by? in Splunk Search

How should I rename a dynamic value after using the timechart count by?

vaibhavvijay9 — Tue, 29 Sep 2020 22:16:42 GMT

Hi All,

I am using this search string as below :
(some data- index, host, etc)............. | xmlkv | search "ns0:ApplicationFunction"=NotifyBusinessPartnerUpdate_Update_1 | timechart count by ns0:Code | rename LifeRetailCBCustomerSolife-Update-007 as "ABC"

Output:

BUT instead of hardcoded LifeRetailCBCustomerSolife-Update-007 I want it to be dynamic as ns0:Code , see below :
(some data- index, host, etc)............. | xmlkv | search "ns0:ApplicationFunction"=NotifyBusinessPartnerUpdate_Update_1 | timechart count by ns0:Code | rename ns0:Code as "ABC"

Output :

So please help me to get the output same as first but using the second way of search string.

Thanks in advance.

*Please don't go with the attached images filenames.

Re: How should I rename a dynamic value after using the timechart count by?

sergeye — Mon, 03 Dec 2018 16:12:04 GMT

Hi If ns0:Code has only 1 value you can make the renaming before the timechart command
so it should be:

(some data- index, host, etc)............. 
| xmlkv 
| search "ns0:ApplicationFunction"=NotifyBusinessPartnerUpdate_Update_1 
| replace "*" in ns0:Code with "ABC"
| timechart count by ns0:Code

Re: How should I rename a dynamic value after using the timechart count by?

vaibhavvijay9 — Fri, 07 Dec 2018 07:11:03 GMT

Hi, ns0:Code has more than one value.
And want help on one more thing, that I want to rename it with a dynamic value and not with "ABC". So is there any concept of variables??

Thanks in advance.

Re: How should I rename a dynamic value after using the timechart count by?

petom — Fri, 07 Dec 2018 07:26:17 GMT

Use values mapping. E.g. :

<index and filter> | xmlkv | search "ns0:ApplicationFunction"=NotifyBusinessPartnerUpdate_Update_1
| eval dynvalue=case(ns0:Code="value1","label1", ns0:Code="value2","label2", ....)
| timechart count by dynvalue