Splunk Search

Makeresult with hosts and date range

New Member

I am aiming to provide headers to my generated report. I have 3 hosts, host1 host2 and host3. My report is configured with -7d@d to -1d@d (past 7 days).

I would like to makeresults for the following output:


host1   Date1

host1   Date2

host1   Date3


host1   Date7

host2   Date1

host2   Date2



host3    Date7

i have tried the following:

| makeresults

| eval HOST=“host1 host2 host3”

| makemv delims=“ “ HOST

| mvexpand HOST

and a combination of 

| bucket _time span=1d

| stats count by HOST, _time

appreciate any insights into this, thanks!

Labels (1)
0 Karma



You're on the right track with makeresults. Here's one possible solution:

| makeresults count=7
| streamstats count
| eval _time=relative_time(_time-86400*count, "@d")
| fields - count
| eval host="host1 host2 host3", host=split(host, " ")
| mvexpand host
| table host _time
| sort host _time
| rename host as HOST, _time as DATE
| fieldformat DATE=strftime(DATE, "%F")

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...