Splunk Search

Rename column in the Stats fuction with the values of the Field

dashield
Explorer

I would like to get a stats per week of a Customer that would be result like the Table 1.

The data I'm playing with is 100+ Customer and randomly values.

Table 1.

WeekCustomerACustomerBCustomerCCustomerDCustomerE
2760003722
28110003521
2965005620
3033007213
3140023

 

Sample Raw log data:

DateCustomerPenalty
11-DecCustomerACode32
2-NovCustomerBCode32
3-OctCustomerACode31
5-DecCustomerACode01
5-NovCustomerACode22
5-NovCustomerCCode11
9-NovCustomerBCode31

 

I used the Span command  to compile it as per Week and did the stats command below however this result not showing the way I need it.

 

 

|stats count by Customer by Week

 

 

My goal is to count the penalty of each customer per week and do some stack bar graph.
dashield_0-1608886150725.png

Is there a way to count the specific value of the field(Customer) and use that KEY to be column name just like the Table 1 above?

Labels (1)
Tags (2)
0 Karma
1 Solution

saravanan90
Contributor

Please check if this helps .

saravanan90_1-1608888691028.png

 

View solution in original post

saravanan90
Contributor

Please check if this helps .

saravanan90_1-1608888691028.png

 

dashield
Explorer

Thanks a lot. The result is what I need.

0 Karma

saravanan90
Contributor

Below may help

| timechart span=1w count by Customer | eval week=strftime(_time, "%U")

dashield
Explorer

The command below are not working. It shows invalid argument.

| timechart span=1w count by Customer

 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...