https://community.splunk.com/t5/Splunk-Search/Makeresult-with-hosts-and-date-range/m-p/550966#M156330 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/131920">@cboonyan</a>&nbsp;</P><P>You're on the right track with makeresults. Here's one possible solution:</P><P>| makeresults count=7<BR />| streamstats count<BR />| eval _time=relative_time(_time-86400*count, "@d")<BR />| fields - count<BR />| eval host="host1 host2 host3", host=split(host, " ")<BR />| mvexpand host<BR />| table host _time<BR />| sort host _time<BR />| rename host as HOST, _time as DATE<BR />| fieldformat DATE=strftime(DATE, "%F")</P> Sat, 08 May 2021 14:51:57 GMT tscroggins 2021-05-08T14:51:57Z https://community.splunk.com/t5/Splunk-Search/Makeresult-with-hosts-and-date-range/m-p/550963#M156328 <P>I am aiming to provide headers to my generated report. I have 3 hosts, host1 host2 and host3. My report is configured with -7d@d to -1d@d (past 7 days).</P><P>I would like to makeresults for the following output:</P><P>HOST &nbsp; DATE</P><P>host1 &nbsp; Date1</P><P>host1 &nbsp; Date2</P><P>host1 &nbsp; Date3</P><P>...</P><P>host1 &nbsp; Date7</P><P>host2 &nbsp; Date1</P><P>host2 &nbsp; Date2</P><P>...</P><P>...</P><P>host3 &nbsp; &nbsp;Date7</P><P>i have tried the following:</P><P class="lia-indent-padding-left-30px">| makeresults</P><P class="lia-indent-padding-left-30px"><SPAN>| eval HOST=“host1 host2 host3”</SPAN></P><P class="lia-indent-padding-left-30px">| makemv delims=“ “ HOST</P><P class="lia-indent-padding-left-30px">| mvexpand HOST</P><P>and a combination of&nbsp;</P><P class="lia-indent-padding-left-30px">| bucket _time span=1d</P><P class="lia-indent-padding-left-30px"><SPAN>| stats count by HOST, _time</SPAN></P><P><SPAN>appreciate any insights into this, thanks!</SPAN></P> Sat, 08 May 2021 14:31:28 GMT https://community.splunk.com/t5/Splunk-Search/Makeresult-with-hosts-and-date-range/m-p/550963#M156328 cboonyan 2021-05-08T14:31:28Z https://community.splunk.com/t5/Splunk-Search/Makeresult-with-hosts-and-date-range/m-p/550966#M156330 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/131920">@cboonyan</a>&nbsp;</P><P>You're on the right track with makeresults. Here's one possible solution:</P><P>| makeresults count=7<BR />| streamstats count<BR />| eval _time=relative_time(_time-86400*count, "@d")<BR />| fields - count<BR />| eval host="host1 host2 host3", host=split(host, " ")<BR />| mvexpand host<BR />| table host _time<BR />| sort host _time<BR />| rename host as HOST, _time as DATE<BR />| fieldformat DATE=strftime(DATE, "%F")</P> Sat, 08 May 2021 14:51:57 GMT https://community.splunk.com/t5/Splunk-Search/Makeresult-with-hosts-and-date-range/m-p/550966#M156330 tscroggins 2021-05-08T14:51:57Z