topic Re: Add Date to report in Reporting

Add Date to report

gjsmarsh — Tue, 07 Jul 2020 22:32:27 GMT

Hi There.

I'm fairly new to Splunk reporting. I have inherited this fairly simple report.

index=* Level=ERROR | stats count(index) by index | sort indexTotal desc

That just shows a count of errors by index.

I need to add another column to the report that just shows the current date.

Thanks in advance for any help!

Re: Add Date to report

bowesmana — Tue, 07 Jul 2020 22:59:21 GMT

If you just want to add the current date/time to the report you can just add the following line after the stats, which will set the _time column to the current time.

| eval _time=now()

Note that your existing search is a little wrong in that the stats count doesn't give the aggregation the name you are using in the sort command. I suspect you meant

index=* Level=ERROR | stats count as Total by index | sort index Total desc | eval _time=now()

Couple of points

1. Do you want to sort first by index then by total - could be that your largest count of errors would be at the bottom. Maybe this, which would give you descending total but ascending index order

| sort - Total, + index

2. Also not that using wildcard on index will not always give you ALL indexes, as that will depend on your permissions, but it will also not return any of the internal indexes, prefixed with _

Hope this helps.

Re: Add Date to report

gjsmarsh — Tue, 07 Jul 2020 23:10:15 GMT

Thanks so much! I need to do a tutorial or something on Splunk Queries but this gets me moving out the door.

And yeah I had removed the alias from the actual query and forgot to add it in the sample I shared. Thanks also for pointing that out 🙂