How to rename dynamic column name?

[jiaqya]

i have a dynamic column which is bascially today's date, but the column name is 05-02-2020 for example.
i would like to change this column name to "Today"

unfortunately the output of the query i am getting this column name like the date...

can you suggest a way to rename this column name which is dynamic for each day as "Today"

if i try , |rename "05-02-2020" as Today it works, but the date changes tomorrow....

[kamlesh_vaghela]

@jiaqya

Not sure about the rename dynamic field. But I can help you in creating Today field with dynamic value.

YOUR_SEARCH  | eval Today=""
| foreach * [ eval tm=strftime(now(),"%d-%m-%Y"), Today=if("<<FIELD>>"==tm,'<<FIELD>>',Today) ] | fields - tm

Sample search

| makeresults count=7 | eval a=1 | accum a | eval col="0".a."-02-2020" | eval {col}="My Value".a | fields - _time, col, a | stats values(*) as *
| rename comment as "Upto this is for data generation only" | eval Today=""
| foreach * [ eval tm=strftime(now(),"%d-%m-%Y"), Today=if("<<FIELD>>"==tm,'<<FIELD>>',Today) ] | fields - tm

Thanks

[jiaqya]

Kamlesh, thanks , this is perfect. just couple more queries

how do i remove the matching column which is not "Today" , since there are 2 columns now, the actual date and Today..

and the Today column has gone to the end, how do i bring it as 1st column as i want the recent data to be in the begining..

[kamlesh_vaghela]

@jiaqya

I'm working on how to hide actual date column. And you can bring Today first and rest of after by adding below search.

| table Today *

[jiaqya]

Kamlesh, i got the issue fixed by suggestion from gcusello.

[gcusello · Accepted solution]

Hi @jiaqya,
try something like this

index=wineventlog
| timechart count
| eval _time=if(strftime(_time,"%Y-%m-%d")=strftime(now(),"%Y-%m-%d"),"Today",_time)

Ciao.
Giuseppe

[jiaqya]

this was even better...
This renamed the date column to Today and also retained its position in the table.
thank you..

this is what got me working..

|eval column=if(strftime(relative_time(now(), "-1d"), "%b %d %Y")=column,"Today",column)

below is the output , it replaced "Feb 05 2020" with Today

Type Today Feb 04 2020 Feb 03 2020 Feb 02 2020 Feb 01 2020 Jan 31 2020 Jan 30 2020 Jan 28 2020 Jan 26 2020
Oracle Monitoring NA NA NA NA NA NA NA NA 0
Oracle Password 1 2 NA NA NA NA NA NA NA