Splunk Search

How do I make a field value as a column heading?

ibob0304
Communicator

I would like to display weekday in the column heading.

|Search....
| eval weekday=strftime(now(),"%A")

Output

S.no    | Daily          | weekday
  1        101             Thursday
  2        210             Thursday

Desired Output

S.no    | Daily (Thursday)
  1        101             
  2        210             

Tried xyseries and transpose but I couldn't find a way to flip only one column instead of the whole table.

0 Karma
1 Solution

renjith_nair
Legend

@ibob0304,

This works for me,

|Search....
|eval weekday=strftime(now(),"%A")|eval Daily({weekday})=Daily|fields - Daily,weekday
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

harishalipaka
Motivator

@ibob

| makeresults |eval weekday=strftime(now(),"%A") |eval value=100 |fields - _time | transpose header_field="weekday"
Thanks
Harish

renjith_nair
Legend

@ibob0304,

This works for me,

|Search....
|eval weekday=strftime(now(),"%A")|eval Daily({weekday})=Daily|fields - Daily,weekday
---
What goes around comes around. If it helps, hit it with Karma 🙂

Vijeta
Influencer

you can use this in your first search, you can replace sno column name by Daily as per your query.

eval weekday=strftime(now(),"%A")|eval column_name=sno| eval sno ( {weekday} )= sno

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Catalog Is Now Generally Available on Splunk Cloud Platform

A Unified View of Your Data  Security logs, application events, business data, and historical telemetry often ...

Developer Spotlight with Eduard Lekanne

From Network Engineer to Building Agentic AI for Splunk Eduard Lekanne has been architecting technology ...

From Data Landing to Insight

Search Across More of Your Data Ecosystem The data you need may live in Splunk, high-volume machine data, ...