https://community.splunk.com/t5/Splunk-Search/adding-an-event-to-a-query/m-p/53853#M13117 <P>You could try to use append, something like this</P> <P>index=someindex | append [ search index=someindex | eval SID="Samslara" | head 1 ] | table SID</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/append">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/append</A></P> Wed, 18 Jan 2012 21:17:42 GMT imrago 2012-01-18T21:17:42Z https://community.splunk.com/t5/Splunk-Search/adding-an-event-to-a-query/m-p/53852#M13116 <P>Hello,<BR /> I have a problem with trying to add a manual event to a query. For example I have a query that produces a list of session ids (SID). I would also like to add another event and this event would only have static information. So given a query that produces the following data:</P> <H1>SID</H1> <P>aa<BR /> bb<BR /> cc</P> <P>I want to modify this query to produce this:</P> <H1>SID</H1> <P>Samslara<BR /> aa<BR /> bb<BR /> cc</P> <P>where "Samslara" is statically declared in the query.<BR /> What's the best way to do this?</P> Wed, 18 Jan 2012 20:01:41 GMT https://community.splunk.com/t5/Splunk-Search/adding-an-event-to-a-query/m-p/53852#M13116 Samslara 2012-01-18T20:01:41Z https://community.splunk.com/t5/Splunk-Search/adding-an-event-to-a-query/m-p/53853#M13117 <P>You could try to use append, something like this</P> <P>index=someindex | append [ search index=someindex | eval SID="Samslara" | head 1 ] | table SID</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/append">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/append</A></P> Wed, 18 Jan 2012 21:17:42 GMT https://community.splunk.com/t5/Splunk-Search/adding-an-event-to-a-query/m-p/53853#M13117 imrago 2012-01-18T21:17:42Z