topic Re: Internal field `_serial` is gone in v6.2.3; why? in Splunk Search

Internal field `_serial` is gone in v6.2.3; why?

woodcock — Fri, 12 Jun 2015 13:29:43 GMT

I only just found out about the existence of the internal _serial field which should be equal to the row-number less 1 (e.g. first row has _serial value of 0, second row has _serial value of 1, etc.) but no matter what I do, I cannot get examples that have been posted here before that use _serial to work. What is the deal with _serial? When did it go away and was it deliberate or a bug?

Re: Internal field `_serial` is gone in v6.2.3; why?

yannK — Sat, 13 Jun 2015 12:56:42 GMT

I never heard of this field. What is the notion of row number in splunk ?
was it for CSV files ? Because this is gone since the 6.* and the INDEXED_EXTRACTIONS.

In case the field is there but hidden, try :
- try to cast it in a field with an eval first.

<my search> | eval serial=_serial | table serial _raw

or maybe try to add it to the fields.conf

Re: Internal field `_serial` is gone in v6.2.3; why?

acharlieh — Sat, 13 Jun 2015 20:40:23 GMT

I upgraded a 6.2.1 instance to 6.2.3 and I'm able to still see _serial and other hidden fields in results doing a search like index=_internal | fields - _raw | rename _* as *_x | table *_x That said, _serial and other hidden fields can be altered and destroyed by transforming commands. So the question is what examples are you trying that seem to not be working?

Re: Internal field `_serial` is gone in v6.2.3; why?

woodcock — Sat, 13 Jun 2015 21:04:58 GMT

Based on the comment by @acharlieh I went back and played around and have concluded that _serial only exists for the first set of events that are returned (whatever is under the events tab). Evidently _serial is destroyed by doing any other commands which modify the initial result-set in any way, never to be recalculated. This is extremely unfortunate since this makes _serial pretty much useless. My situation was that I was hoping to use it after doing a stats command but it is gone by then. To remedy this, I regenerated _serial myself like this instead:

... | streamstats current=f count AS _serial