is there any command to get row numbers in table?
Like,
I have a table like
host source type
DFR splunk_id
FGH splunkd
THG splunk_ui
i would like to have like:
NO host source type
1 DFR splunk_id
2 FGH splunkd
3 THG splunk_ui
You can try these.
your current search | eval NO=1 | accum NO
or
your current search | streamstats count as NO
streamstats might be worth considering. Below is a standalone example.
| makeresults count=3 | streamstats count
In your case just pipe the query to streamstats
.. | streamstats count
Thank you so much, it works
You can try these.
your current search | eval NO=1 | accum NO
or
your current search | streamstats count as NO