Is it possible to calculate the value of a field name, or assign a field name using a value of a previously calculated field?

[DonDallas71]

Is it possible to calculate the value of a field name, or assign a field name using a value of a previously calculated field?

In a Splunk search I have a calculated field that is a date like 6/29/2017 and i want to create a field using stats that has that name. I want the actual field/column name to be that calculated date and not some static text.

value of Day1=6/29/2017
value of Day2=6/28/2017
value of Day1Users is a list of all users who logged in on 6/29/2017
value of Day2Users is a list of all users who logged in on 6/29/2017 and 6/28/2017
I want to do something like this

| stats DC(Day1Users) as {Day1}, DC(Day2Users) as {Day2}....

[woodcock · Accepted solution]

To assign a field name from a field value do this:

| eval {FieldNameWhoseValueShouldBeTheNewFieldName} = whatever.

So if field FieldX has value X and FieldY has a value Y and you do | eval {FieldX} = FieldY then you will have a new field named X that has a value of Y.

[DonDallas71]

That was exactly what I was wanting to do. I had actually tried that, I had just forgotten to carry my date variables through to my stats.

[sbbadri]

..... earliest=-2d@d latest=-0d@d | timechart span=1d count by users | eval _time = strftime(_time,"%Y-%m-%d") | fields - _span _spandays | transpose