Solved: Re: Modification in CSV report - Splunk Community

Reporting

Please advise.

1 Solution

Solution

index =* source=*MIG* a_agent=* | bin spans=1d _time | stats count by _time a_agent | eval time=strftime(relative_time(now(),"@h"), "%F %T") | eval report="SBB0;INtegrationPLatform;".a_agent.";".count.";".time| fields - _* |table report

View solution in original post

Solution

index =* source=*MIG* a_agent=* | bin spans=1d _time | stats count by _time a_agent | eval time=strftime(relative_time(now(),"@h"), "%F %T") | eval report="SBB0;INtegrationPLatform;".a_agent.";".count.";".time| fields - _* |table report

Have you tried transpose?

Get Updates on the Splunk Community!

Self-Healing Pipeline Is Now Generally Available: AI-Powered CIM Compliance

Maintaining data integrity across security and analytics pipelines is an ongoing challenge. Data ...

Meet Splunk Observability Studio: AI-Assisted OpenTelemetry Instrumentation Without ...

Instrumentation is usually the last step or even an afterthought when building out a project. The feature ...

Federated Search for Cisco Security and Analytics Logging (SAL) is now GA on Splunk ...

Federated Search for Cisco Security Analytics and Logging (SAL) is now generally available as part of the ...