Splunk Search

adding an event to a query

Samslara
Explorer

Hello,
I have a problem with trying to add a manual event to a query. For example I have a query that produces a list of session ids (SID). I would also like to add another event and this event would only have static information. So given a query that produces the following data:

SID

aa
bb
cc

I want to modify this query to produce this:

SID

Samslara
aa
bb
cc

where "Samslara" is statically declared in the query.
What's the best way to do this?

Tags (1)
0 Karma

imrago
Contributor

You could try to use append, something like this

index=someindex | append [ search index=someindex | eval SID="Samslara" | head 1 ] | table SID

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/append

Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...