Splunk Search

How do I make a field value as a column heading?

ibob0304
Communicator

I would like to display weekday in the column heading.

|Search....
| eval weekday=strftime(now(),"%A")

Output

S.no    | Daily          | weekday
  1        101             Thursday
  2        210             Thursday

Desired Output

S.no    | Daily (Thursday)
  1        101             
  2        210             

Tried xyseries and transpose but I couldn't find a way to flip only one column instead of the whole table.

0 Karma
1 Solution

renjith_nair
Legend

@ibob0304,

This works for me,

|Search....
|eval weekday=strftime(now(),"%A")|eval Daily({weekday})=Daily|fields - Daily,weekday
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

harishalipaka
Motivator

@ibob

| makeresults |eval weekday=strftime(now(),"%A") |eval value=100 |fields - _time | transpose header_field="weekday"
Thanks
Harish

renjith_nair
Legend

@ibob0304,

This works for me,

|Search....
|eval weekday=strftime(now(),"%A")|eval Daily({weekday})=Daily|fields - Daily,weekday
---
What goes around comes around. If it helps, hit it with Karma 🙂

Vijeta
Influencer

you can use this in your first search, you can replace sno column name by Daily as per your query.

eval weekday=strftime(now(),"%A")|eval column_name=sno| eval sno ( {weekday} )= sno

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...