Makeresult with hosts and date range

[cboonyan]

I am aiming to provide headers to my generated report. I have 3 hosts, host1 host2 and host3. My report is configured with -7d@d to -1d@d (past 7 days).

I would like to makeresults for the following output:

HOST   DATE

host1   Date1

host1   Date2

host1   Date3

...

host1   Date7

host2   Date1

host2   Date2

...

...

host3    Date7

i have tried the following:

| makeresults

| eval HOST=“host1 host2 host3”

| makemv delims=“ “ HOST

| mvexpand HOST

and a combination of 

| bucket _time span=1d

| stats count by HOST, _time

appreciate any insights into this, thanks!

[tscroggins]

@cboonyan 

You're on the right track with makeresults. Here's one possible solution:

| makeresults count=7
| streamstats count
| eval _time=relative_time(_time-86400*count, "@d")
| fields - count
| eval host="host1 host2 host3", host=split(host, " ")
| mvexpand host
| table host _time
| sort host _time
| rename host as HOST, _time as DATE
| fieldformat DATE=strftime(DATE, "%F")