Splunk Search

Splunk Javascript SDK: Is it possible to include column headings as a row in the chart array?

bk028s
Path Finder

Hi all,

I'm currently working with the Splunk SDK for JavaScript and I am having some difficulties formatting the data from queries. I have a search that looks like this:

* | chart count by _time my_field limit=0 usenull=f useother=f

Which in Splunk looks something like this:

_time                  A    B   C   D
2017-01-26 10:18:42 2   4   8   0
2017-01-26 10:18:43 0   7   6   3
2017-01-26 10:18:44 4   9   5   2
2017-01-26 10:18:46 7   0   5   0

But when I get the results from running the query through the JavaScript SDK, the array I get is basically this:

2017-01-26 10:18:42 2   4   8   0
2017-01-26 10:18:43 0   7   6   3
2017-01-26 10:18:44 4   9   5   2
2017-01-26 10:18:46 7   0   5   0

(without the headers)

Is there an easy way to include the column headers in the array I get in JavaScript?

0 Karma
1 Solution

bk028s
Path Finder

I'm going to post what I'm using as a kind of work-around right now, but I also want to leave this question open in the hopes that someone smarter or more well-versed in Splunking will provide a cleaner solution.

I've done this:

* | eval time=strftime(_time, "%a, %d %b %Y %H:%M:%S") | chart count by my_field time limit=0 usenull=f useother=f | transpose 0

The time formatting is irrelevant to the actual workaround, which is just to switch my_field and _time in the chart and then transpose the result.

View solution in original post

0 Karma

bk028s
Path Finder

I'm going to post what I'm using as a kind of work-around right now, but I also want to leave this question open in the hopes that someone smarter or more well-versed in Splunking will provide a cleaner solution.

I've done this:

* | eval time=strftime(_time, "%a, %d %b %Y %H:%M:%S") | chart count by my_field time limit=0 usenull=f useother=f | transpose 0

The time formatting is irrelevant to the actual workaround, which is just to switch my_field and _time in the chart and then transpose the result.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...