Splunk Search

How do I make a field value as a column heading?

ibob0304
Communicator

I would like to display weekday in the column heading.

|Search....
| eval weekday=strftime(now(),"%A")

Output

S.no    | Daily          | weekday
  1        101             Thursday
  2        210             Thursday

Desired Output

S.no    | Daily (Thursday)
  1        101             
  2        210             

Tried xyseries and transpose but I couldn't find a way to flip only one column instead of the whole table.

0 Karma
1 Solution

renjith_nair
Legend

@ibob0304,

This works for me,

|Search....
|eval weekday=strftime(now(),"%A")|eval Daily({weekday})=Daily|fields - Daily,weekday
Happy Splunking!

View solution in original post

harishalipaka
Motivator

@ibob

| makeresults |eval weekday=strftime(now(),"%A") |eval value=100 |fields - _time | transpose header_field="weekday"
Thanks
Harish

renjith_nair
Legend

@ibob0304,

This works for me,

|Search....
|eval weekday=strftime(now(),"%A")|eval Daily({weekday})=Daily|fields - Daily,weekday
Happy Splunking!

Vijeta
Influencer

you can use this in your first search, you can replace sno column name by Daily as per your query.

eval weekday=strftime(now(),"%A")|eval column_name=sno| eval sno ( {weekday} )= sno

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...