topic Re: How to rename dynamic column name? in Splunk Search

How to rename dynamic column name?

jiaqya — Thu, 06 Feb 2020 11:14:23 GMT

i have a dynamic column which is bascially today's date, but the column name is 05-02-2020 for example.
i would like to change this column name to "Today"

unfortunately the output of the query i am getting this column name like the date...

can you suggest a way to rename this column name which is dynamic for each day as "Today"

if i try , |rename "05-02-2020" as Today it works, but the date changes tomorrow....

Re: How to rename dynamic column name?

gcusello — Thu, 06 Feb 2020 11:31:24 GMT

Hi @jiaqya,
try something like this

index=wineventlog
| timechart count
| eval _time=if(strftime(_time,"%Y-%m-%d")=strftime(now(),"%Y-%m-%d"),"Today",_time)

Ciao.
Giuseppe

Re: How to rename dynamic column name?

kamlesh_vaghela — Thu, 06 Feb 2020 11:51:23 GMT

@jiaqya

Not sure about the rename dynamic field. But I can help you in creating Today field with dynamic value.

YOUR_SEARCH  | eval Today=""
| foreach * [ eval tm=strftime(now(),"%d-%m-%Y"), Today=if("<<FIELD>>"==tm,'<<FIELD>>',Today) ] | fields - tm

Sample search

| makeresults count=7 | eval a=1 | accum a | eval col="0".a."-02-2020" | eval {col}="My Value".a | fields - _time, col, a | stats values(*) as *
| rename comment as "Upto this is for data generation only" | eval Today=""
| foreach * [ eval tm=strftime(now(),"%d-%m-%Y"), Today=if("<<FIELD>>"==tm,'<<FIELD>>',Today) ] | fields - tm

Thanks

Re: How to rename dynamic column name?

jiaqya — Thu, 06 Feb 2020 12:00:46 GMT

Kamlesh, thanks , this is perfect. just couple more queries

how do i remove the matching column which is not "Today" , since there are 2 columns now, the actual date and Today..

and the Today column has gone to the end, how do i bring it as 1st column as i want the recent data to be in the begining..

Re: How to rename dynamic column name?

jiaqya — Thu, 06 Feb 2020 12:17:58 GMT

this was even better...
This renamed the date column to Today and also retained its position in the table.
thank you..

this is what got me working..

|eval column=if(strftime(relative_time(now(), "-1d"), "%b %d %Y")=column,"Today",column)

below is the output , it replaced "Feb 05 2020" with Today

Type Today Feb 04 2020 Feb 03 2020 Feb 02 2020 Feb 01 2020 Jan 31 2020 Jan 30 2020 Jan 28 2020 Jan 26 2020
Oracle Monitoring NA NA NA NA NA NA NA NA 0
Oracle Password 1 2 NA NA NA NA NA NA NA

Re: How to rename dynamic column name?

kamlesh_vaghela — Thu, 06 Feb 2020 12:28:38 GMT

@jiaqya

I'm working on how to hide actual date column. And you can bring Today first and rest of after by adding below search.

| table Today *

Re: How to rename dynamic column name?

jiaqya — Thu, 06 Feb 2020 12:29:45 GMT

Kamlesh, i got the issue fixed by suggestion from gcusello.