Dashboards & Visualizations

[Splunk + R] How do I dynamically rename the column name of results obtained from running an R script on a splunk query?

m_vivek
Path Finder

I have a splunk + R query :

index=abcd host=pqrs*   earliest=07/01/2015:00:0:0 latest=07/02/2015:01:0:0 | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR) by TYPE | eval dataset=1 | append[index=abcd host=pqrs*   earliest=07/03/2015:00:0:0 latest=07/04/2015:01:0:0 | fields DUR, TYPE | timechart limit=0 span=10m count, avg(DUR) by TYPE  | eval dataset=2] | r "   data= input 
.
.
.
output =  my_output"

the output looks like this :
alt text

Q.1
This kind of output is looked at every two weeks. How do I rename the columns so that they also display a proper name along with the date range chosen in the query in Splunk?
Ex: I want the Count.Pre column to look like Count 07/01 to 07/02 ,
and Count.post as Count 07/03 to 07/04 and similarly for the other columns whose results are dependent on the date.
(I know renaming columns can be done it in multiple ways using R)

Q.2 How do I do it dynamically? i.e if the date range in the query is changed the names of the columns in the results should also reflect the same change mentioned above.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Here's a run-anywhere non-R example:

| stats count as Median.Pre | addinfo | eval dynamic_part = strftime(info_min_time, "%m/%d")." to ".strftime(info_max_time, "%m/%d") | eval Median {dynamic_part} = 'Median.Pre' | fields - info_* Median.Pre dynamic_part

m_vivek
Path Finder

@martin_mueller thanks.
Doing the above is changing the name dynamically but it is displaying only that specific column with only one value. how to display the results in my screen shot 'as is' but only with a change of column name?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

The entire search I posted is a standalone dummy example. Paste it into an empty search bar and see what it does to the generated field, then adapt to your actual query.

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...