Splunk Search

How to rename dynamic column name?

jiaqya
Builder

i have a dynamic column which is bascially today's date, but the column name is 05-02-2020 for example.
i would like to change this column name to "Today"

unfortunately the output of the query i am getting this column name like the date...

can you suggest a way to rename this column name which is dynamic for each day as "Today"

if i try , |rename "05-02-2020" as Today it works, but the date changes tomorrow....

Tags (1)
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jiaqya,
try something like this

index=wineventlog
| timechart count
| eval _time=if(strftime(_time,"%Y-%m-%d")=strftime(now(),"%Y-%m-%d"),"Today",_time)

Ciao.
Giuseppe

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jiaqya

Not sure about the rename dynamic field. But I can help you in creating Today field with dynamic value.

YOUR_SEARCH  | eval Today=""
| foreach * [ eval tm=strftime(now(),"%d-%m-%Y"), Today=if("<<FIELD>>"==tm,'<<FIELD>>',Today) ] | fields - tm

Sample search

| makeresults count=7 | eval a=1 | accum a | eval col="0".a."-02-2020" | eval {col}="My Value".a | fields - _time, col, a | stats values(*) as *
| rename comment as "Upto this is for data generation only" | eval Today=""
| foreach * [ eval tm=strftime(now(),"%d-%m-%Y"), Today=if("<<FIELD>>"==tm,'<<FIELD>>',Today) ] | fields - tm

Thanks

0 Karma

jiaqya
Builder

Kamlesh, thanks , this is perfect. just couple more queries

how do i remove the matching column which is not "Today" , since there are 2 columns now, the actual date and Today..

and the Today column has gone to the end, how do i bring it as 1st column as i want the recent data to be in the begining..

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@jiaqya

I'm working on how to hide actual date column. And you can bring Today first and rest of after by adding below search.

| table Today *

0 Karma

jiaqya
Builder

Kamlesh, i got the issue fixed by suggestion from gcusello.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jiaqya,
try something like this

index=wineventlog
| timechart count
| eval _time=if(strftime(_time,"%Y-%m-%d")=strftime(now(),"%Y-%m-%d"),"Today",_time)

Ciao.
Giuseppe

jiaqya
Builder

this was even better...
This renamed the date column to Today and also retained its position in the table.
thank you..

this is what got me working..

|eval column=if(strftime(relative_time(now(), "-1d"), "%b %d %Y")=column,"Today",column)

below is the output , it replaced "Feb 05 2020" with Today

Type Today Feb 04 2020 Feb 03 2020 Feb 02 2020 Feb 01 2020 Jan 31 2020 Jan 30 2020 Jan 28 2020 Jan 26 2020
Oracle Monitoring NA NA NA NA NA NA NA NA 0
Oracle Password 1 2 NA NA NA NA NA NA NA

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...