Splunk Search

How to add a column with date field in a chart

sfmandmdev
Path Finder

I have this query-

index=myIndex logRecordTypeX=1 
(logName="abc" OR logName="def" OR logName="ghi" OR logName="jkl" OR logName="mno") 
starttime="08/31/2010:00:00:00.000" endtime="08/31/2010:23:59:59.999" | fields logName, organizationId | eval logName=lower(logName) | chart count as pageViews over organizationId by logName limit=50 | addtotals fieldname=totalPageviews | sort –totalPageviews

I want to add another columns to my search results called Date ( it will display the same value in all rows- ie 8/31/2010). How can I do that?

Tags (1)
0 Karma

sfmandmdev
Path Finder

I finally used this as a workaround(ie appending date to one of the column values)

index=myIndex logRecordTypeX=1 (logName="abc" OR logName="def" OR logName="ghi" OR logName="jkl" OR logName="mno") starttime="08/31/2010:00:00:00.000" endtime="08/31/2010:23:59:59.999" | fields logName, organizationId,_time | eval Time=strftime(_time,"%m/%d") | eval NewOid = organizationId+" "+Time | chart count as pageViews over NewOid by logName limit=50

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

If you want to hardcode the date here, you can just add | eval Date = "8/31/2010" but I suppose you want to be more clever and have it be based on the search itself.

In that case you should add:

... | addinfo | eval Date = strftime(info_min_time, "%m/%d/%Y") | fields - info_*
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...