Splunk Search

Rename column in the Stats fuction with the values of the Field

dashield
Explorer

I would like to get a stats per week of a Customer that would be result like the Table 1.

The data I'm playing with is 100+ Customer and randomly values.

Table 1.

WeekCustomerACustomerBCustomerCCustomerDCustomerE
2760003722
28110003521
2965005620
3033007213
3140023

 

Sample Raw log data:

DateCustomerPenalty
11-DecCustomerACode32
2-NovCustomerBCode32
3-OctCustomerACode31
5-DecCustomerACode01
5-NovCustomerACode22
5-NovCustomerCCode11
9-NovCustomerBCode31

 

I used the Span command  to compile it as per Week and did the stats command below however this result not showing the way I need it.

 

 

|stats count by Customer by Week

 

 

My goal is to count the penalty of each customer per week and do some stack bar graph.
dashield_0-1608886150725.png

Is there a way to count the specific value of the field(Customer) and use that KEY to be column name just like the Table 1 above?

Labels (1)
Tags (2)
0 Karma
1 Solution

saravanan90
Contributor

Please check if this helps .

saravanan90_1-1608888691028.png

 

View solution in original post

saravanan90
Contributor

Please check if this helps .

saravanan90_1-1608888691028.png

 

dashield
Explorer

Thanks a lot. The result is what I need.

0 Karma

saravanan90
Contributor

Below may help

| timechart span=1w count by Customer | eval week=strftime(_time, "%U")

dashield
Explorer

The command below are not working. It shows invalid argument.

| timechart span=1w count by Customer

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Maximizing the Value of Splunk ES 8.x

Splunk Enterprise Security (ES) continues to be a leader in the Gartner Magic Quadrant, reflecting its pivotal ...