Splunk Javascript SDK: Is it possible to include column headings as a row in the chart array?

[bk028s]

Hi all,

I'm currently working with the Splunk SDK for JavaScript and I am having some difficulties formatting the data from queries. I have a search that looks like this:

* | chart count by _time my_field limit=0 usenull=f useother=f

Which in Splunk looks something like this:

_time                  A    B   C   D
2017-01-26 10:18:42 2   4   8   0
2017-01-26 10:18:43 0   7   6   3
2017-01-26 10:18:44 4   9   5   2
2017-01-26 10:18:46 7   0   5   0

But when I get the results from running the query through the JavaScript SDK, the array I get is basically this:

2017-01-26 10:18:42 2   4   8   0
2017-01-26 10:18:43 0   7   6   3
2017-01-26 10:18:44 4   9   5   2
2017-01-26 10:18:46 7   0   5   0

(without the headers)

Is there an easy way to include the column headers in the array I get in JavaScript?

[bk028s · Accepted solution]

I'm going to post what I'm using as a kind of work-around right now, but I also want to leave this question open in the hopes that someone smarter or more well-versed in Splunking will provide a cleaner solution.

I've done this:

* | eval time=strftime(_time, "%a, %d %b %Y %H:%M:%S") | chart count by my_field time limit=0 usenull=f useother=f | transpose 0

The time formatting is irrelevant to the actual workaround, which is just to switch my_field and _time in the chart and then transpose the result.