Is it possible to calculate the value of a field name, or assign a field name using a value of a previously calculated field?
In a Splunk search I have a calculated field that is a date like 6/29/2017 and i want to create a field using stats that has that name. I want the actual field/column name to be that calculated date and not some static text.
value of Day1=6/29/2017
value of Day2=6/28/2017
value of Day1Users is a list of all users who logged in on 6/29/2017
value of Day2Users is a list of all users who logged in on 6/29/2017 and 6/28/2017
I want to do something like this
| stats DC(Day1Users) as {Day1}, DC(Day2Users) as {Day2}....
... View more