Splunk Search

Splunk Javascript SDK: Is it possible to include column headings as a row in the chart array?

bk028s
Path Finder

Hi all,

I'm currently working with the Splunk SDK for JavaScript and I am having some difficulties formatting the data from queries. I have a search that looks like this:

* | chart count by _time my_field limit=0 usenull=f useother=f

Which in Splunk looks something like this:

_time                  A    B   C   D
2017-01-26 10:18:42 2   4   8   0
2017-01-26 10:18:43 0   7   6   3
2017-01-26 10:18:44 4   9   5   2
2017-01-26 10:18:46 7   0   5   0

But when I get the results from running the query through the JavaScript SDK, the array I get is basically this:

2017-01-26 10:18:42 2   4   8   0
2017-01-26 10:18:43 0   7   6   3
2017-01-26 10:18:44 4   9   5   2
2017-01-26 10:18:46 7   0   5   0

(without the headers)

Is there an easy way to include the column headers in the array I get in JavaScript?

0 Karma
1 Solution

bk028s
Path Finder

I'm going to post what I'm using as a kind of work-around right now, but I also want to leave this question open in the hopes that someone smarter or more well-versed in Splunking will provide a cleaner solution.

I've done this:

* | eval time=strftime(_time, "%a, %d %b %Y %H:%M:%S") | chart count by my_field time limit=0 usenull=f useother=f | transpose 0

The time formatting is irrelevant to the actual workaround, which is just to switch my_field and _time in the chart and then transpose the result.

View solution in original post

0 Karma

bk028s
Path Finder

I'm going to post what I'm using as a kind of work-around right now, but I also want to leave this question open in the hopes that someone smarter or more well-versed in Splunking will provide a cleaner solution.

I've done this:

* | eval time=strftime(_time, "%a, %d %b %Y %H:%M:%S") | chart count by my_field time limit=0 usenull=f useother=f | transpose 0

The time formatting is irrelevant to the actual workaround, which is just to switch my_field and _time in the chart and then transpose the result.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...