topic Re: How do I bring serial number in splunk in Splunk Search

How do I bring serial number in splunk

abhayneilam — Tue, 23 Oct 2012 16:33:00 GMT

Hi,

I have four line result as follows:

value1
value2
value3
value4

but I want the serial no. should be before each line as follows:

1 value1
2 value2
3 value3
4 value

When I export in .csv or .xlsx format. I should get my result along with serial no.

Please help

Re: How do I bring serial number in splunk

yannK — Wed, 24 Oct 2012 03:47:49 GMT

Do you mean serial order or serial number ?

In Splunk the the order is chronological, based on the timestamp.
Or i you want you own order, in your logs, add a columns with an incrementing number.

Re: How do I bring serial number in splunk

abhayneilam — Wed, 24 Oct 2012 12:13:47 GMT

I want to add a separate column which would contain the serial number with the incrementing number.

Please help me regarding this !!

Thanks in Advance
Abhay

Re: How do I bring serial number in splunk

Gilberto_Castil — Wed, 24 Oct 2012 14:00:24 GMT

If I understand your question, you want to have an incremental row number paired with your results. If this is the case, this is similar to this question and a similar answer applies.

The Splunk command you are looking for here is accum -which increments a field value by one.

index=blah sourcetype=blah blah | eval SNO=1 | accum SNO | table SNO Field1

It should be noted, however, that Splunk will show row numbers in a table by default. The numbering will begin at one (1).

Re: How do I bring serial number in splunk

srizan — Fri, 07 Dec 2018 19:32:24 GMT

This definitely helped me!

Re: How do I bring serial number in splunk

jawaharas — Wed, 06 Jan 2021 01:14:02 GMT

You can try 'Format'->'Row Numbers'.