Splunk Search

How can I take date Values as Column Names?

darshana2511
New Member

Hello ,

I am writing one query in Splunk to retrieve the events from a JSON log file. I am getting one value of a table as mentioned in image capture.png.

But I want to take date values as column names. Please refer to capture 1 image. Can you please help me as early as possible?

I look forward to hearing from you.

Thank you in advance.

alt text

alt text

0 Karma

FrankVl
Ultra Champion

A bit difficult without seeing the rest of your data / field names, but try something like this:

...your current search...
| chart Result over System by New_Date

Note: those merged cells like "Date" and "AD" cannot be done in splunk (well, not unless you go all out custom html/js in a dashboard, that is).

0 Karma

accsam
New Member

use the transpose command

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...