topic Re: Create 1-up number (1-to-n) field for each event and create field that combines the 1-up number and total count in Splunk Search

Create 1-up number (1-to-n) field for each event and create field that combines the 1-up number and total count

williamcharlton — Mon, 18 Mar 2019 13:48:40 GMT

I have a search that returns a event count total and produces a table

... | eventstats count AS Total | Table foo, bar, Total

Search result is, e.g.,

foo | bar | Total
fx1 | bx1 | 3
fx2 | bx2 | 3
fx3 | bx3 | 3

My goal is to produce a 4th column named "EventNumber" that shows "E of N" when E is the ordinal position of the event in the search results and N is the total number of events in the search rsults

foo | bar | Total | EventNumber
fx1 | bx1 | 3 | 1 of 3
fx2 | bx2 | 3 | 2 of 3
fx3 | bx3 | 3 | 3 of 3

So, something like

... eventstats count AS Total | Table Cluster, OwnerNode, RoleName, Total | eval EventNumber = ?????." of ".Total

How do I create a 1-up number (1-to-n) field for each event and create a field that combines the 1-up number and total count of events?

Re: Create 1-up number (1-to-n) field for each event and create field that combines the 1-up number and total count

somesoni2 — Mon, 18 Mar 2019 15:09:40 GMT

Try like this

...| eventstats count AS Total 
| streamstats count as sno 
| eval EventNumber = sno." of ".Total
| Table Cluster, OwnerNode, RoleName, Total  EventNumber

Re: Create 1-up number (1-to-n) field for each event and create field that combines the 1-up number and total count

williamcharlton — Mon, 18 Mar 2019 15:20:21 GMT

I see - The streamstats command calculates statistics for each event at the time the event is seen

Good to know. Thank -you