topic Re: Dynamic column name in Splunk Search

Dynamic column name

smolcj — Mon, 01 Apr 2013 10:28:34 GMT

Hi,
My search is like given below and my column names are source file names. As the source file name consists of directory name, timestamp etc, it is too long to be a column name. I have extracted another field log_name with just the name of the source file without any time stamp or other stuffs. but how can i use the log_name variable in the search so that i can replace the source file name with log name.

I know that, there is an alternative idea of extracting the log_name during search time but i don't want the search to be some more lengthy, so i didn't do that. I am curious to know whether there is any other alternative for the same.
Search Query :

 index=main  source="$sources$" 
| stats values(wrkf) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(reponame) as "Repo Name", values(version) as "Version", values(mode) as "Mode",values(order) as "Order"
|transpose 
|rename column as Properties, "row 1" as "$sources$"
|appendcols [ search  index=main  source="$sourcessecond$" 
    | stats values(wrkf) as "Work Name", values(name) as "Name", values(folder) as "Folder Name", values(reponame) as "Repo Name", values(version) as "Version", values(mode) as "Mode",values(order) as "Order"
     |transpose |rename column as Properties, "row 1" as "$sourcessecond$"] 
|where  '$sources$'!=  '$sourcessecond$'

Please Help
Thank You

Re: Dynamic column name

lguinn2 — Wed, 03 Apr 2013 07:07:28 GMT

If you have extracted a field named log_name, you can use it in the search like any other field. For example,

index=main log_name=whatever

Re: Dynamic column name

smolcj — Wed, 03 Apr 2013 08:47:32 GMT

thanks lguinn !!! but how can i replace it instead of $sources$ and $sourcessecond$ in

 

     |rename column as Properties, "row 1" as "$sourcessecond$"] 

|where  '$sources$'!=  '$sourcessecond$'

Re: Dynamic column name

jldebell — Mon, 28 Sep 2020 18:45:00 GMT

Hi - I have something similar. I was curious to see if you were able to figure it out? I am extracting the action from the logs using regex. Then timecharting. i have three actions listed and i wanted to rename the column headers.

Search is:

index=app_example
sourcetype=provision_example
|rex field=_raw "(?logErrorResult\s+[\d+]+:[A-Za-z\s+]+\s+)"

|search action="*"

|timechart span=1d count by action

So displayed is showing something like the following:

_time action results (code #1) action results (code #2) action results (code #3)
2015-01-28 Rename to User Failure Rename to System Failure Rename to User/System

I want to rename the code # to the message listed below.

Thanks!