Splunk Search

Evaling a value based on the position of the event in stats ?

szabados
Communicator

I create a statistics table, which is sorted, and I use head 10 at the end, to display my results. What I want to do is, to add a new column with a number value, to show the position of the event.
something like this:

col1, col2, col3, position <---- thats what I want to add
value, value, value, 1
value, value, value, 2
value, value, value, 3
value, value, value, 4

How can I achieve this ?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

I believe you just want to add rownumber type of field. Try any one of below

Your current search which give your table | eval position=1 | accum position

OR

Your current search which give your table |streamstats count as position
0 Karma

badrinath_itrs
Communicator

Hi,

You can try something like this to populate the additional column .

your search ... | eval position="1,2,3,4," | makemv delim="," position | mvexpand position |  table col1, col2, col3, col4, position | head 4

You can change the position value and head command limit as per your requirement.

Hope it helps.

Thanks

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...