Knowledge Management

Is it possible to calculate the value of a field name, or assign a field name using a value of a previously calculated field?

DonDallas71
New Member

Is it possible to calculate the value of a field name, or assign a field name using a value of a previously calculated field?

In a Splunk search I have a calculated field that is a date like 6/29/2017 and i want to create a field using stats that has that name. I want the actual field/column name to be that calculated date and not some static text.

value of Day1=6/29/2017
value of Day2=6/28/2017
value of Day1Users is a list of all users who logged in on 6/29/2017
value of Day2Users is a list of all users who logged in on 6/29/2017 and 6/28/2017
I want to do something like this

| stats DC(Day1Users) as {Day1}, DC(Day2Users) as {Day2}....
0 Karma
1 Solution

woodcock
Esteemed Legend

To assign a field name from a field value do this:

| eval {FieldNameWhoseValueShouldBeTheNewFieldName} = whatever.

So if field FieldX has value X and FieldY has a value Y and you do | eval {FieldX} = FieldY then you will have a new field named X that has a value of Y.

View solution in original post

0 Karma

woodcock
Esteemed Legend

To assign a field name from a field value do this:

| eval {FieldNameWhoseValueShouldBeTheNewFieldName} = whatever.

So if field FieldX has value X and FieldY has a value Y and you do | eval {FieldX} = FieldY then you will have a new field named X that has a value of Y.

0 Karma

DonDallas71
New Member

That was exactly what I was wanting to do. I had actually tried that, I had just forgotten to carry my date variables through to my stats.

0 Karma

sbbadri
Motivator

..... earliest=-2d@d latest=-0d@d | timechart span=1d count by users | eval _time = strftime(_time,"%Y-%m-%d") | fields - _span _spandays | transpose

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...