Dashboards & Visualizations

[Splunk + R] How do I dynamically rename the column name of results obtained from running an R script on a splunk query?

m_vivek
Path Finder

I have a splunk + R query :

index=abcd host=pqrs*   earliest=07/01/2015:00:0:0 latest=07/02/2015:01:0:0 | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR) by TYPE | eval dataset=1 | append[index=abcd host=pqrs*   earliest=07/03/2015:00:0:0 latest=07/04/2015:01:0:0 | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR) by TYPE  | eval dataset=2] | r "   data= input 
.
.
.
output =  my_output"

the output looks like this :
alt text

Q.1
This kind of output is looked at every two weeks. How do I rename the columns so that they also display a proper name along with the date range chosen in the query in Splunk?
Ex: I want the Count.Pre column to look like Count 07/01 to 07/02 ,
and Count.post as Count 07/03 to 07/04 and similarly for the other columns whose results are dependent on the date.
(I know renaming columns can be done it in multiple ways using R)

Q.2 How do I do it dynamically? i.e if the date range in the query is changed the names of the columns in the results should also reflect the same change mentioned above.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Here's a run-anywhere non-R example:

| stats count as Median.Pre | addinfo | eval dynamic_part = strftime(info_min_time, "%m/%d")." to ".strftime(info_max_time, "%m/%d") | eval Median {dynamic_part} = 'Median.Pre' | fields - info_* Median.Pre dynamic_part

m_vivek
Path Finder

@martin_mueller thanks.
Doing the above is changing the name dynamically but it is displaying only that specific column with only one value. how to display the results in my screen shot 'as is' but only with a change of column name?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The entire search I posted is a standalone dummy example. Paste it into an empty search bar and see what it does to the generated field, then adapt to your actual query.

Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...