Splunk Search

Rename column in the Stats fuction with the values of the Field

dashield
Explorer

I would like to get a stats per week of a Customer that would be result like the Table 1.

The data I'm playing with is 100+ Customer and randomly values.

Table 1.

WeekCustomerACustomerBCustomerCCustomerDCustomerE
2760003722
28110003521
2965005620
3033007213
3140023

 

Sample Raw log data:

DateCustomerPenalty
11-DecCustomerACode32
2-NovCustomerBCode32
3-OctCustomerACode31
5-DecCustomerACode01
5-NovCustomerACode22
5-NovCustomerCCode11
9-NovCustomerBCode31

 

I used the Span command  to compile it as per Week and did the stats command below however this result not showing the way I need it.

 

 

|stats count by Customer by Week

 

 

My goal is to count the penalty of each customer per week and do some stack bar graph.
dashield_0-1608886150725.png

Is there a way to count the specific value of the field(Customer) and use that KEY to be column name just like the Table 1 above?

Labels (1)
Tags (2)
0 Karma
1 Solution

saravanan90
Contributor

Please check if this helps .

saravanan90_1-1608888691028.png

 

View solution in original post

saravanan90
Contributor

Please check if this helps .

saravanan90_1-1608888691028.png

 

dashield
Explorer

Thanks a lot. The result is what I need.

0 Karma

saravanan90
Contributor

Below may help

| timechart span=1w count by Customer | eval week=strftime(_time, "%U")

dashield
Explorer

The command below are not working. It shows invalid argument.

| timechart span=1w count by Customer

 

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...