Solved: Re: Modification in CSV report - Splunk Community

Reporting

Please advise.

1 Solution

Solution

index =* source=*MIG* a_agent=* | bin spans=1d _time | stats count by _time a_agent | eval time=strftime(relative_time(now(),"@h"), "%F %T") | eval report="SBB0;INtegrationPLatform;".a_agent.";".count.";".time| fields - _* |table report

View solution in original post

Solution

index =* source=*MIG* a_agent=* | bin spans=1d _time | stats count by _time a_agent | eval time=strftime(relative_time(now(),"@h"), "%F %T") | eval report="SBB0;INtegrationPLatform;".a_agent.";".count.";".time| fields - _* |table report

Have you tried transpose?

Get Updates on the Splunk Community!

Index This | What has goals but no motivation?

June 2026 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious! We’re back with this ...

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...