Splunk Search

Rename column in the Stats fuction with the values of the Field

dashield
Explorer

I would like to get a stats per week of a Customer that would be result like the Table 1.

The data I'm playing with is 100+ Customer and randomly values.

Table 1.

WeekCustomerACustomerBCustomerCCustomerDCustomerE
2760003722
28110003521
2965005620
3033007213
3140023

 

Sample Raw log data:

DateCustomerPenalty
11-DecCustomerACode32
2-NovCustomerBCode32
3-OctCustomerACode31
5-DecCustomerACode01
5-NovCustomerACode22
5-NovCustomerCCode11
9-NovCustomerBCode31

 

I used the Span command  to compile it as per Week and did the stats command below however this result not showing the way I need it.

 

 

|stats count by Customer by Week

 

 

My goal is to count the penalty of each customer per week and do some stack bar graph.
dashield_0-1608886150725.png

Is there a way to count the specific value of the field(Customer) and use that KEY to be column name just like the Table 1 above?

Labels (1)
Tags (2)
0 Karma
1 Solution

saravanan90
Contributor

Please check if this helps .

saravanan90_1-1608888691028.png

 

View solution in original post

saravanan90
Contributor

Please check if this helps .

saravanan90_1-1608888691028.png

 

dashield
Explorer

Thanks a lot. The result is what I need.

0 Karma

saravanan90
Contributor

Below may help

| timechart span=1w count by Customer | eval week=strftime(_time, "%U")

dashield
Explorer

The command below are not working. It shows invalid argument.

| timechart span=1w count by Customer

 

0 Karma
Get Updates on the Splunk Community!

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...