Knowledge Management

Is it possible to calculate the value of a field name, or assign a field name using a value of a previously calculated field?

DonDallas71
New Member

Is it possible to calculate the value of a field name, or assign a field name using a value of a previously calculated field?

In a Splunk search I have a calculated field that is a date like 6/29/2017 and i want to create a field using stats that has that name. I want the actual field/column name to be that calculated date and not some static text.

value of Day1=6/29/2017
value of Day2=6/28/2017
value of Day1Users is a list of all users who logged in on 6/29/2017
value of Day2Users is a list of all users who logged in on 6/29/2017 and 6/28/2017
I want to do something like this

| stats DC(Day1Users) as {Day1}, DC(Day2Users) as {Day2}....
0 Karma
1 Solution

woodcock
Esteemed Legend

To assign a field name from a field value do this:

| eval {FieldNameWhoseValueShouldBeTheNewFieldName} = whatever.

So if field FieldX has value X and FieldY has a value Y and you do | eval {FieldX} = FieldY then you will have a new field named X that has a value of Y.

View solution in original post

0 Karma

woodcock
Esteemed Legend

To assign a field name from a field value do this:

| eval {FieldNameWhoseValueShouldBeTheNewFieldName} = whatever.

So if field FieldX has value X and FieldY has a value Y and you do | eval {FieldX} = FieldY then you will have a new field named X that has a value of Y.

0 Karma

DonDallas71
New Member

That was exactly what I was wanting to do. I had actually tried that, I had just forgotten to carry my date variables through to my stats.

0 Karma

sbbadri
Motivator

..... earliest=-2d@d latest=-0d@d | timechart span=1d count by users | eval _time = strftime(_time,"%Y-%m-%d") | fields - _span _spandays | transpose

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...