Hi..
is it possible a field called SNO along with my search search results , which will old the serial no of events .i.e 0 ,1 ,2 ,,and so on..
i.e i need the following when i use the table command ..
SNO Field Field
0 data data
1 data data
2 data data
....
.
.
.
and so on..
how can i do this ??
please help..
Hello,
If the field SNO does not exist, you can dynamically create it during search time. The Splunk command you are looking for here is accum -which increments a field value by one.
There is one small catch here, the command will not begin to increment if the field value starts with a zero. Nonetheless, there is a way around it. Here is a quick search that should help:
index=blah sourcetype=blah blah | eval SNO=1 | accum SNO | eval SNO=SNO-1 | table SNO Field1 Field2
It should be noted, however, that Splunk will show row numbers in a table by default. The numbering will begin at one (1).
Hello,
If the field SNO does not exist, you can dynamically create it during search time. The Splunk command you are looking for here is accum -which increments a field value by one.
There is one small catch here, the command will not begin to increment if the field value starts with a zero. Nonetheless, there is a way around it. Here is a quick search that should help:
index=blah sourcetype=blah blah | eval SNO=1 | accum SNO | eval SNO=SNO-1 | table SNO Field1 Field2
It should be noted, however, that Splunk will show row numbers in a table by default. The numbering will begin at one (1).