Splunk Search

Splunk Javascript SDK: Is it possible to include column headings as a row in the chart array?

bk028s
Path Finder

Hi all,

I'm currently working with the Splunk SDK for JavaScript and I am having some difficulties formatting the data from queries. I have a search that looks like this:

* | chart count by _time my_field limit=0 usenull=f useother=f

Which in Splunk looks something like this:

_time                  A    B   C   D
2017-01-26 10:18:42 2   4   8   0
2017-01-26 10:18:43 0   7   6   3
2017-01-26 10:18:44 4   9   5   2
2017-01-26 10:18:46 7   0   5   0

But when I get the results from running the query through the JavaScript SDK, the array I get is basically this:

2017-01-26 10:18:42 2   4   8   0
2017-01-26 10:18:43 0   7   6   3
2017-01-26 10:18:44 4   9   5   2
2017-01-26 10:18:46 7   0   5   0

(without the headers)

Is there an easy way to include the column headers in the array I get in JavaScript?

0 Karma
1 Solution

bk028s
Path Finder

I'm going to post what I'm using as a kind of work-around right now, but I also want to leave this question open in the hopes that someone smarter or more well-versed in Splunking will provide a cleaner solution.

I've done this:

* | eval time=strftime(_time, "%a, %d %b %Y %H:%M:%S") | chart count by my_field time limit=0 usenull=f useother=f | transpose 0

The time formatting is irrelevant to the actual workaround, which is just to switch my_field and _time in the chart and then transpose the result.

View solution in original post

0 Karma

bk028s
Path Finder

I'm going to post what I'm using as a kind of work-around right now, but I also want to leave this question open in the hopes that someone smarter or more well-versed in Splunking will provide a cleaner solution.

I've done this:

* | eval time=strftime(_time, "%a, %d %b %Y %H:%M:%S") | chart count by my_field time limit=0 usenull=f useother=f | transpose 0

The time formatting is irrelevant to the actual workaround, which is just to switch my_field and _time in the chart and then transpose the result.

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...