Hi all,
I'm currently working with the Splunk SDK for JavaScript and I am having some difficulties formatting the data from queries. I have a search that looks like this:
* | chart count by _time my_field limit=0 usenull=f useother=f
Which in Splunk looks something like this:
_time A B C D
2017-01-26 10:18:42 2 4 8 0
2017-01-26 10:18:43 0 7 6 3
2017-01-26 10:18:44 4 9 5 2
2017-01-26 10:18:46 7 0 5 0
But when I get the results from running the query through the JavaScript SDK, the array I get is basically this:
2017-01-26 10:18:42 2 4 8 0
2017-01-26 10:18:43 0 7 6 3
2017-01-26 10:18:44 4 9 5 2
2017-01-26 10:18:46 7 0 5 0
(without the headers)
Is there an easy way to include the column headers in the array I get in JavaScript?
I'm going to post what I'm using as a kind of work-around right now, but I also want to leave this question open in the hopes that someone smarter or more well-versed in Splunking will provide a cleaner solution.
I've done this:
* | eval time=strftime(_time, "%a, %d %b %Y %H:%M:%S") | chart count by my_field time limit=0 usenull=f useother=f | transpose 0
The time formatting is irrelevant to the actual workaround, which is just to switch my_field and _time in the chart and then transpose the result.
I'm going to post what I'm using as a kind of work-around right now, but I also want to leave this question open in the hopes that someone smarter or more well-versed in Splunking will provide a cleaner solution.
I've done this:
* | eval time=strftime(_time, "%a, %d %b %Y %H:%M:%S") | chart count by my_field time limit=0 usenull=f useother=f | transpose 0
The time formatting is irrelevant to the actual workaround, which is just to switch my_field and _time in the chart and then transpose the result.