topic Re: how to add a column in Splunk Enterprise

how to add a column

Keerthi — Fri, 30 Jun 2023 10:29:54 GMT

Hi , needed a help. i need to add a column that is added newly to the sql data.below is the query
| savedsearch ABC
| join type=left BS_ID [| search index="PQR" source=XYZ
| rename BS_CODE as BS_ID SERVICE_OWNER as "System Owner" BUSINESS_OWNER as "Business Owner" SERVICE_SUBCATEGORY as Function SDM_FULLNAME as SDM
| sort LOGICAL_NAME | eval Application = DESCRIPTION
| rex mode=sed field=Application "s/^Managed//g" | rex mode=sed field=Application "s/Application$//g" | rex mode=sed field=Application "s/application$//g"
| eval Application = trim(Application)
| streamstats count as NO by BS_ID
| eventstats max(NO) as MaxTotal by BS_ID
| where NO=MaxTotal
|eval Function=case(Function="Service Excellence COE" and Application="Medical Insights Reporting","Service Excellence CoE",1=1,Function)
| table BS_ID Application Function SDM "System Owner" "Business Owner"]
| lookup countries.csv name as COUNTRY outputnew latitude, longitude, name
| eval COUNTRY = if(isnull(COUNTRY),"NA",COUNTRY)
| eval DEPARTMENT_LONG_NAME = if(isnull(DEPARTMENT_LONG_NAME),"NA",DEPARTMENT_LONG_NAME)
| eval DEPARTMENT_SHORT_NAME = if(isnull(DEPARTMENT_SHORT_NAME),"NA",DEPARTMENT_SHORT_NAME)

my ABC savedsearch has a column newly added as Category. i need to get into this saved search

Re: how to add a column

isoutamo — Fri, 30 Jun 2023 11:01:15 GMT

Based on your query, it should be there (just "correctly" formatted, You get this by press Ctrl/Cmd+F)

| savedsearch ABC | join type=left BS_ID [| search index="PQR" source=XYZ | rename BS_CODE as BS_ID SERVICE_OWNER as "System Owner" BUSINESS_OWNER as "Business Owner" SERVICE_SUBCATEGORY as Function SDM_FULLNAME as SDM | sort LOGICAL_NAME | eval Application = DESCRIPTION | rex mode=sed field=Application "s/^Managed//g" | rex mode=sed field=Application "s/Application$//g" | rex mode=sed field=Application "s/application$//g" | eval Application = trim(Application) | streamstats count as NO by BS_ID | eventstats max(NO) as MaxTotal by BS_ID | where NO=MaxTotal | eval Function=case(Function="Service Excellence COE" and Application="Medical Insights Reporting","Service Excellence CoE",1=1,Function) | table BS_ID Application Function SDM "System Owner" "Business Owner"] | lookup countries.csv name as COUNTRY outputnew latitude, longitude, name | eval COUNTRY = if(isnull(COUNTRY),"NA",COUNTRY) | eval DEPARTMENT_LONG_NAME = if(isnull(DEPARTMENT_LONG_NAME),"NA",DEPARTMENT_LONG_NAME) | eval DEPARTMENT_SHORT_NAME = if(isnull(DEPARTMENT_SHORT_NAME),"NA",DEPARTMENT_SHORT_NAME)

Are you sure that your

| savedsearch ABC

return that field, when you are running it that way?

r. Ismo