Splunk Search

Makeresult with hosts and date range

New Member

I am aiming to provide headers to my generated report. I have 3 hosts, host1 host2 and host3. My report is configured with -7d@d to -1d@d (past 7 days).

I would like to makeresults for the following output:


host1   Date1

host1   Date2

host1   Date3


host1   Date7

host2   Date1

host2   Date2



host3    Date7

i have tried the following:

| makeresults

| eval HOST=“host1 host2 host3”

| makemv delims=“ “ HOST

| mvexpand HOST

and a combination of 

| bucket _time span=1d

| stats count by HOST, _time

appreciate any insights into this, thanks!

Labels (1)
0 Karma



You're on the right track with makeresults. Here's one possible solution:

| makeresults count=7
| streamstats count
| eval _time=relative_time(_time-86400*count, "@d")
| fields - count
| eval host="host1 host2 host3", host=split(host, " ")
| mvexpand host
| table host _time
| sort host _time
| rename host as HOST, _time as DATE
| fieldformat DATE=strftime(DATE, "%F")

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...