All Apps and Add-ons

Adding a row count field (sequence number) to a record in the index time field extraction

yuwtennis
Communicator

Hi!

I want to creae a index that has a sequence number field per record.

In props.conf , there is a field extraction option "EVAL-field name".

Would this be a option to implement a such function?

Thanks,
Yu

0 Karma

sowings
Splunk Employee
Splunk Employee

No, eval won't do what you want here.

What problem are you trying to solve? I can offer suggestions to get you closer to what you want, but only if I know where it is you're trying to go.

0 Karma

sowings
Splunk Employee
Splunk Employee

Since you mentioned that you're preparing this for "export" to another database system, is it that system that needs the sequence ID? If so, we could generate the sequence ID at search time when you're ready to send the data for export.

0 Karma

yuwtennis
Communicator

I thought that best way is to put a number at the index-time
field extraction but it seems not to work.

0 Karma

yuwtennis
Communicator

Hello sowings.

Thank you for the reply.

What I want to do is to create a table that contains
a sequence number

seq f1 f2 f3
1 1 2 3
2 4 5 6
3 1 2 3
4 1 2 3

Also, I am considering to input csv data from the external
application and every time splunk reads the data
I want this seq to count up
So , if following new data is gathered

new data
f1 f2 f3
7 8 9

It will be like,

seq f1 f2 f3
1 1 2 3
2 4 5 6
3 1 2 3
4 1 2 3
5 7 8 9

The reason I need this is I need to create csv file contains
seq which is needed for external application's database.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...