Splunk Search

How to add a column with date field in a chart

Path Finder

I have this query-

index=myIndex logRecordTypeX=1 
(logName="abc" OR logName="def" OR logName="ghi" OR logName="jkl" OR logName="mno") 
starttime="08/31/2010:00:00:00.000" endtime="08/31/2010:23:59:59.999" | fields logName, organizationId | eval logName=lower(logName) | chart count as pageViews over organizationId by logName limit=50 | addtotals fieldname=totalPageviews | sort –totalPageviews

I want to add another columns to my search results called Date ( it will display the same value in all rows- ie 8/31/2010). How can I do that?

Tags (1)
0 Karma

Path Finder

I finally used this as a workaround(ie appending date to one of the column values)

index=myIndex logRecordTypeX=1 (logName="abc" OR logName="def" OR logName="ghi" OR logName="jkl" OR logName="mno") starttime="08/31/2010:00:00:00.000" endtime="08/31/2010:23:59:59.999" | fields logName, organizationId,_time | eval Time=strftime(_time,"%m/%d") | eval NewOid = organizationId+" "+Time | chart count as pageViews over NewOid by logName limit=50

0 Karma

Splunk Employee
Splunk Employee

If you want to hardcode the date here, you can just add | eval Date = "8/31/2010" but I suppose you want to be more clever and have it be based on the search itself.

In that case you should add:

... | addinfo | eval Date = strftime(info_min_time, "%m/%d/%Y") | fields - info_*