topic Display row numbers in output in Splunk Search

Display row numbers in output

efelder0 — Thu, 16 Feb 2012 21:33:17 GMT

I am indexing a CSV file into Splunk and wish to display the row number in a seperate column called 'row count'.

Example:

Field 1 Field 2 Row Count Field 3
blah blah 1 blah
blah blah 2 blah
blah blah 3 blah

What is the best method to achieve this?

Thanks.

efelder0 — Thu, 16 Feb 2012 21:43:46 GMT

Would displayRowNumbers work here? If so, how would it be configured in my search query?

sanderdenheijer — Sun, 17 Jan 2016 21:25:11 GMT

Add ... | streamstats count as "Row Count" to your search

MuS — Mon, 18 Jan 2016 02:43:26 GMT

Hi efelder0,

you can set this in viewstates.conf or in your XML with this option:

<option name="displayRowNumbers">true</option>

This will work in the recent Splunk releases.

wrangler2x — Tue, 19 Jan 2016 20:29:18 GMT

Adding to /opt/splunk/etc/apps/search/local/viewstates.conf does not seem to do anything in the search app.