Splunk Search

Can I tag with search?

kawashita_t
Explorer

I would like to tag you at search time.
I'd like to tag the result of the calculation when searching.

ex )
LogID Data1 Data2
1 323 421
2 391 117
3 341 221
4 268 230
5 182 311
6 277 213
7 57 177
8 27 251
9 72 235
10 201 257

Tag the sum of Data 1 and Data 2.

result:

LogID Data1 Data2 tag
1   323   421   744
2   391   117   508
3   341   221   562
4   268   230   498
5   182   311   493
6   277   213   490
7   57   177   234
8   27   251   278
9   72   235   307
10   201   257   458

index=sample
| eval sum=Data1+Data2
| tags outputfield=sum tag  ###Example Tagging syntax

I want you to tell me.
If I can not do that, will I use a summary index etc?

0 Karma

arizviherjavec
Explorer

Why not just

| eval tag=Data1+Data2 ?

If you need both tag and sum fields, you can also
| eval sum=tag

0 Karma

inventsekar
SplunkTrust
SplunkTrust

as field "sum" is not indexed, i think you can not use it as a tag.
i think what you are looking for is "calculated field".

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...