Dashboards & Visualizations

[Splunk + R] How do I dynamically rename the column name of results obtained from running an R script on a splunk query?

m_vivek
Path Finder

I have a splunk + R query :

index=abcd host=pqrs*   earliest=07/01/2015:00:0:0 latest=07/02/2015:01:0:0 | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR) by TYPE | eval dataset=1 | append[index=abcd host=pqrs*   earliest=07/03/2015:00:0:0 latest=07/04/2015:01:0:0 | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR) by TYPE  | eval dataset=2] | r "   data= input 
.
.
.
output =  my_output"

the output looks like this :
alt text

Q.1
This kind of output is looked at every two weeks. How do I rename the columns so that they also display a proper name along with the date range chosen in the query in Splunk?
Ex: I want the Count.Pre column to look like Count 07/01 to 07/02 ,
and Count.post as Count 07/03 to 07/04 and similarly for the other columns whose results are dependent on the date.
(I know renaming columns can be done it in multiple ways using R)

Q.2 How do I do it dynamically? i.e if the date range in the query is changed the names of the columns in the results should also reflect the same change mentioned above.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Here's a run-anywhere non-R example:

| stats count as Median.Pre | addinfo | eval dynamic_part = strftime(info_min_time, "%m/%d")." to ".strftime(info_max_time, "%m/%d") | eval Median {dynamic_part} = 'Median.Pre' | fields - info_* Median.Pre dynamic_part

m_vivek
Path Finder

@martin_mueller thanks.
Doing the above is changing the name dynamically but it is displaying only that specific column with only one value. how to display the results in my screen shot 'as is' but only with a change of column name?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The entire search I posted is a standalone dummy example. Paste it into an empty search bar and see what it does to the generated field, then adapt to your actual query.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...