topic Re: Renaming column at runtime without knowing at coding time their names. in Splunk Search

Renaming column at runtime without knowing at coding time their names.

andreafebbo — Fri, 26 Aug 2016 09:03:30 GMT

Hi.
I have the following query

BASE QUERY earliest=-7d latest=now | bucket _time span=7d |  stats count as events by  source _time |chart sum(events) by source, _time

this query gives me the column source and, in this case, 2 columns (that if i change earliest and span, become N columns).

the deal is that those columns are names by the time, in some strange format (1471557600 and 1472162400).

so, in this case, I have 3 columns: source - 1471557600 - 1472162400.

I need to dynamically rename the columns by position, without knowing their names at run time.

Is there some command like: rename the 2nd column = "this week" ans the 3rd column = "last week" ?

Thank you

Re: Renaming column at runtime without knowing at coding time their names.

martin_mueller — Fri, 26 Aug 2016 11:41:19 GMT

Have you considered using the timewrap command?

https://splunkbase.splunk.com/app/1645/

Re: Renaming column at runtime without knowing at coding time their names.

sundareshr — Fri, 26 Aug 2016 13:10:19 GMT

Try this

 BASE QUERY earliest=-14d latest=now | eval when=if(_time>relative_time(now(), "-7d@d"), "Current Week, "Prev Week") |  stats count as events by  source when |chart sum(events) by source, when

Re: Renaming column at runtime without knowing at coding time their names.

andreafebbo — Mon, 29 Aug 2016 10:02:41 GMT

I works!
Thanks a lot!

Re: Renaming column at runtime without knowing at coding time their names.

andreafebbo — Mon, 29 Aug 2016 10:03:34 GMT

Thanks!
I didn't use the timewrap for solving this issue but I will use it for other issues.