topic Add a row to end of table in Splunk Search

Add a row to end of table

simonattardGO — Mon, 27 Feb 2012 14:00:39 GMT

Hi,

I am running a scheduled search to output some logs to a file. Now I would like to add an extra line to the end of each file, so that it acts as a footer for the file. I.e. I want to add the words " END OF FILE" to the end of each file.

Which is the best way to do this?

Thanks a lot!

Re: Add a row to end of table

_d_ — Mon, 27 Feb 2012 14:39:14 GMT

Assuming your search looks like this:

<my search here> | stats count by param1, param2, param3

Here is a quick way to do it:

<my search here> | stats count by param1, param2, param3 | append [|stats count |eval count="END OF FILE"]

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!