Knowledge Management

Is it possible to calculate the value of a field name, or assign a field name using a value of a previously calculated field?

DonDallas71
New Member

Is it possible to calculate the value of a field name, or assign a field name using a value of a previously calculated field?

In a Splunk search I have a calculated field that is a date like 6/29/2017 and i want to create a field using stats that has that name. I want the actual field/column name to be that calculated date and not some static text.

value of Day1=6/29/2017
value of Day2=6/28/2017
value of Day1Users is a list of all users who logged in on 6/29/2017
value of Day2Users is a list of all users who logged in on 6/29/2017 and 6/28/2017
I want to do something like this

| stats DC(Day1Users) as {Day1}, DC(Day2Users) as {Day2}....
0 Karma
1 Solution

woodcock
Esteemed Legend

To assign a field name from a field value do this:

| eval {FieldNameWhoseValueShouldBeTheNewFieldName} = whatever.

So if field FieldX has value X and FieldY has a value Y and you do | eval {FieldX} = FieldY then you will have a new field named X that has a value of Y.

View solution in original post

0 Karma

woodcock
Esteemed Legend

To assign a field name from a field value do this:

| eval {FieldNameWhoseValueShouldBeTheNewFieldName} = whatever.

So if field FieldX has value X and FieldY has a value Y and you do | eval {FieldX} = FieldY then you will have a new field named X that has a value of Y.

View solution in original post

0 Karma

DonDallas71
New Member

That was exactly what I was wanting to do. I had actually tried that, I had just forgotten to carry my date variables through to my stats.

0 Karma

sbbadri
Motivator

..... earliest=-2d@d latest=-0d@d | timechart span=1d count by users | eval _time = strftime(_time,"%Y-%m-%d") | fields - _span _spandays | transpose

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!