https://community.splunk.com/t5/Splunk-Search/How-to-calculate-and-add-missing-field-to-source/m-p/427881#M172567 <P>Thanks @richgalloway. I thought enough to do that, but my mistake was not carrying the by clause to the end. Makes sense to me now. Thank you.</P> Tue, 12 Mar 2019 12:22:40 GMT user93 2019-03-12T12:22:40Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-and-add-missing-field-to-source/m-p/427877#M172563 <P>source A : filename,title,version,type,date<BR /> source B: filename,date</P> <P>I want to compute the title field for source b and output that into my data where the file name has the same value for source A and B.</P> <PRE><CODE>Goal: source=b | table _time,filename,title </CODE></PRE> <P>Where source b does not include the title in the _raw but source a has the same filename and also includes title in the _raw.</P> Mon, 11 Mar 2019 17:09:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-and-add-missing-field-to-source/m-p/427877#M172563 user93 2019-03-11T17:09:03Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-and-add-missing-field-to-source/m-p/427878#M172564 <P>Try this:</P> <PRE><CODE>(source=A OR source=B) | stats latest(_time) as _time, latest(title) as title by filename | table _time, filename, title </CODE></PRE> Mon, 11 Mar 2019 17:26:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-and-add-missing-field-to-source/m-p/427878#M172564 richgalloway 2019-03-11T17:26:33Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-and-add-missing-field-to-source/m-p/427879#M172565 <P>This works, but what I really want is for the events to become a new field in the search, because now I cannot add other fields lost to the stats pipe. For example, I want: | table _time,filename,title,version,w_day</P> Tue, 29 Sep 2020 23:36:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-and-add-missing-field-to-source/m-p/427879#M172565 user93 2020-09-29T23:36:50Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-and-add-missing-field-to-source/m-p/427880#M172566 <P>To avoid losing fields to <CODE>stats</CODE>, include them in <CODE>stats</CODE>. <CODE>... | stats latest(_time) as _time, latest(title) as title latest(version) as version, latest(w_day) as w_day by filename | ...</CODE>.</P> Tue, 12 Mar 2019 11:59:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-and-add-missing-field-to-source/m-p/427880#M172566 richgalloway 2019-03-12T11:59:44Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-and-add-missing-field-to-source/m-p/427881#M172567 <P>Thanks @richgalloway. I thought enough to do that, but my mistake was not carrying the by clause to the end. Makes sense to me now. Thank you.</P> Tue, 12 Mar 2019 12:22:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-and-add-missing-field-to-source/m-p/427881#M172567 user93 2019-03-12T12:22:40Z