Solved: Modification - Splunk Community

Reporting

Please advise.

1 Solution

Solution

index =* source=*MIG* a_agent=* | bin spans=1d _time | stats count by _time a_agent | eval time=strftime(relative_time(now(),"@h"), "%F %T") | eval report="SBB0;INtegrationPLatform;".a_agent.";".count.";".time| fields - _* |table report

View solution in original post

Solution

index =* source=*MIG* a_agent=* | bin spans=1d _time | stats count by _time a_agent | eval time=strftime(relative_time(now(),"@h"), "%F %T") | eval report="SBB0;INtegrationPLatform;".a_agent.";".count.";".time| fields - _* |table report

Have you tried transpose?

Get Updates on the Splunk Community!

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner

Your Path to AgenticOps: AI Experiences for Every Splunk Practitioner Watch on demand us for a demo-driven ...

The Data Connection - October 2026

We all have data. Lots of it. But that’s not the problem – it’s understanding what we should we do with it, ...

Beyond the Acceleration Zone: Maximizing Your Success with Splunk Customer Experience ...

Customer success is built on tailored guidance and accessible resources. As a Splunk user, you are encouraged ...