https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371578#M109345 <P>not really claer what you want, can you give a sample of what your table looks like currently and how you would want it to appear?</P> Mon, 02 Oct 2017 15:06:00 GMT Sukisen1981 2017-10-02T15:06:00Z https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371575#M109342 <P>Hi,</P> <P>I'm searching multiple sources in a single index and getting the results as a table. I want to display the sourcename next to the first column for each row. How can I do that ?</P> Mon, 02 Oct 2017 13:53:53 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371575#M109342 charanramireddy 2017-10-02T13:53:53Z https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371576#M109343 <P>You mean like this?</P> <PRE><CODE>&lt;base search&gt; | table foo source ... </CODE></PRE> Mon, 02 Oct 2017 14:37:06 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371576#M109343 richgalloway 2017-10-02T14:37:06Z https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371577#M109344 <P>yes but </P> <PRE><CODE>table "prior column names" source </CODE></PRE> <P>shows empty column for source.</P> Mon, 02 Oct 2017 14:44:48 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371577#M109344 charanramireddy 2017-10-02T14:44:48Z https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371578#M109345 <P>not really claer what you want, can you give a sample of what your table looks like currently and how you would want it to appear?</P> Mon, 02 Oct 2017 15:06:00 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371578#M109345 Sukisen1981 2017-10-02T15:06:00Z https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371579#M109346 <P>@charanramireddy, Are you saying the following works</P> <PRE><CODE> &lt;YourBaseSearch&gt; | table source foo </CODE></PRE> <P>But revrsing the sequence does not?</P> <PRE><CODE> &lt;YourBaseSearch&gt; | table source foo </CODE></PRE> <P>What type of data input is it? What is going to be the first column in the table? Are you able to see <CODE>source</CODE> names when you run your base search under interesting fields? What is the exact <CODE>table</CODE> command you are running?</P> Mon, 02 Oct 2017 15:16:00 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371579#M109346 niketn 2017-10-02T15:16:00Z https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371580#M109347 <P>This is my sample search</P> <PRE><CODE>index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local | sort 0 - COL2 </CODE></PRE> <P>and I want a new column appended with source values as second column.</P> Mon, 02 Oct 2017 15:21:58 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371580#M109347 charanramireddy 2017-10-02T15:21:58Z https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371581#M109348 <P>index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local | sort 0 - COL2<BR /> If I just add <BR /> index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local, latest (source) as COL5 | sort 0 - COL2<BR /> or if you want to see ALL the source values in one go<BR /> index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local, values (source) as COL5 | sort 0 - COL2</P> <P>Coming back to what @niketnilay is asking is source an auto discovered field or you want to extract a custom source field?</P> Mon, 02 Oct 2017 15:54:10 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371581#M109348 Sukisen1981 2017-10-02T15:54:10Z https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371582#M109349 <P>Try like this</P> <PRE><CODE> index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local source | sort 0 - COL2 </CODE></PRE> Mon, 02 Oct 2017 15:56:40 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371582#M109349 somesoni2 2017-10-02T15:56:40Z https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371583#M109350 <P>this is exactly what I was looking for.</P> Mon, 02 Oct 2017 15:58:55 GMT https://community.splunk.com/t5/Splunk-Search/Help-with-forming-a-table-with-sourcename-next-to-the-first/m-p/371583#M109350 charanramireddy 2017-10-02T15:58:55Z