topic Re: Rename column in the Stats fuction with the values of the Field in Splunk Search

Rename column in the Stats fuction with the values of the Field

dashield — Fri, 25 Dec 2020 08:51:31 GMT

I would like to get a stats per week of a Customer that would be result like the Table 1.

The data I'm playing with is 100+ Customer and randomly values.

Table 1.

Week	CustomerA	CustomerB	CustomerC	CustomerD	CustomerE
27	60	0	0	37	22
28	110	0	0	35	21
29	65	0	0	56	20
30	33	0	0	72	13
31	4	0	0	2	3

Sample Raw log data:

Date	Customer	Penalty
11-Dec	CustomerA	Code32
2-Nov	CustomerB	Code32
3-Oct	CustomerA	Code31
5-Dec	CustomerA	Code01
5-Nov	CustomerA	Code22
5-Nov	CustomerC	Code11
9-Nov	CustomerB	Code31

I used the Span command to compile it as per Week and did the stats command below however this result not showing the way I need it.

|stats count by Customer by Week

My goal is to count the penalty of each customer per week and do some stack bar graph.

Is there a way to count the specific value of the field(Customer) and use that KEY to be column name just like the Table 1 above?

Re: Rename column in the Stats fuction with the values of the Field

saravanan90 — Fri, 25 Dec 2020 07:45:53 GMT

Below may help

| timechart span=1w count by Customer | eval week=strftime(_time, "%U")

Re: Rename column in the Stats fuction with the values of the Field

dashield — Fri, 25 Dec 2020 08:42:29 GMT

The command below are not working. It shows invalid argument.

| timechart span=1w count by Customer

Re: Rename column in the Stats fuction with the values of the Field

saravanan90 — Fri, 25 Dec 2020 09:32:18 GMT

Please check if this helps .

Re: Rename column in the Stats fuction with the values of the Field

dashield — Fri, 25 Dec 2020 12:27:38 GMT

Thanks a lot. The result is what I need.