Splunk Search

How do I make a field value as a column heading?

ibob0304
Communicator

I would like to display weekday in the column heading.

|Search....
| eval weekday=strftime(now(),"%A")

Output

S.no    | Daily          | weekday
  1        101             Thursday
  2        210             Thursday

Desired Output

S.no    | Daily (Thursday)
  1        101             
  2        210             

Tried xyseries and transpose but I couldn't find a way to flip only one column instead of the whole table.

0 Karma
1 Solution

renjith_nair
Legend

@ibob0304,

This works for me,

|Search....
|eval weekday=strftime(now(),"%A")|eval Daily({weekday})=Daily|fields - Daily,weekday
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

harishalipaka
Motivator

@ibob

| makeresults |eval weekday=strftime(now(),"%A") |eval value=100 |fields - _time | transpose header_field="weekday"
Thanks
Harish

renjith_nair
Legend

@ibob0304,

This works for me,

|Search....
|eval weekday=strftime(now(),"%A")|eval Daily({weekday})=Daily|fields - Daily,weekday
---
What goes around comes around. If it helps, hit it with Karma 🙂

Vijeta
Influencer

you can use this in your first search, you can replace sno column name by Daily as per your query.

eval weekday=strftime(now(),"%A")|eval column_name=sno| eval sno ( {weekday} )= sno

Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...