topic Re: How do you add dummy events to a search result? in Splunk Search

How do you add dummy events to a search result?

Marinus — Tue, 08 May 2012 12:23:00 GMT

I'm currently producing a table from a search. There is some static data that needs to be added which is not in the index and needs to be added at search time. I'm toying with the idea to create a new search command to do this, is there an easier way?

* | table name phone

Let's assume I need to add another name?

* | dummy_event name=bob, phone=555-1234 |table name phone

Re: How do you add dummy events to a search result?

ziegfried — Tue, 08 May 2012 14:06:34 GMT

There are a few options on how to do this without creating a custom search command:

... | append [ | stats count | fields - count | eval name="Bob" | eval phone="555-1234" ]

or using a csv lookup file

... | outputlookup mydummyresults.csv append=t

Re: How do you add dummy events to a search result?

Marinus — Thu, 10 May 2012 18:27:48 GMT

creative, I think I'm going to hack together a quick script.

Re: How do you add dummy events to a search result?

hegleg — Thu, 23 Jun 2016 13:02:30 GMT

Since 6.3.0 you can use

| makeresults

link text

Re: How do you add dummy events to a search result?

rstitt — Sat, 07 Jan 2017 00:57:45 GMT

Check out the new "makeresults" command

Re: How do you add dummy events to a search result?

greich — Tue, 18 Jul 2017 23:51:27 GMT

while the accepted answer above works, it is a trick. the search command makeresults is the correct answer
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makeresults

Re: How do you add dummy events to a search result?

bbialek — Thu, 01 Feb 2018 00:11:07 GMT

Here is something that can help you... First, generate dummy columns and single row of results:

 index=nothing_to_see_here |stats count| eval col1="beep" | eval col2="boop"|table col1 col2
┌──────┬──────┐
│ col1 │ col2 │
├──────┼──────┤
│ beep │ boop │
└──────┴──────┘

Append data from another dummy search:

index=nothing_to_see_here |stats count | eval col1="beep" | eval col2="boop" | table col1 col2 | append [search index=nothing_to_see_here | stats count | eval col1="science" | eval col2="magic" | table col1 col2 ]
┌─────────┬───────┐
│  col1   │ col2  │
├─────────┼───────┤
│ beep    │ boop  │
│ science │ magic │
└─────────┴───────┘

Re: How do you add dummy events to a search result?

greich — Thu, 01 Feb 2018 08:33:56 GMT

as mentioned above, the correct answer is the markresults command
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Makeresults