topic Re: Custom field for numbering/naming - requires loop ? in Splunk Search

Custom field for numbering/naming - requires loop ?

crt89 — Mon, 21 Jul 2014 08:10:01 GMT

Hi Good day Splunkers,

I was stuck on this simple problem. I want to make a field for my numbering/naming. I believe this can be attain by EVAL command. What I was trying to do is I have to show a table that consist of 11 results. I want to make a field before to it that indicates its name/number. Like 1 for row 1, then 2 for row 2

example:

name - result

1 - 200kb

2 - 250kb

3 - 300kb

4 - 350kb

5 - 400kb

How will my search be ? I was thinking a loop with eval but don't know where to start

Thanks,

Re: Custom field for numbering/naming - requires loop ?

martin_mueller — Mon, 21 Jul 2014 10:03:52 GMT

I don't really understand your question, but you can do eval loops with foreach: http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/foreach

Re: Custom field for numbering/naming - requires loop ?

martin_mueller — Mon, 21 Jul 2014 11:52:47 GMT

Are you by chance looking for this?

... | streamstats count as name

Re: Custom field for numbering/naming - requires loop ?

crt89 — Tue, 22 Jul 2014 02:11:58 GMT

@martin_mueller Wow thanks, this is what I need. Now how can I make your comment as an answer.

Re: Custom field for numbering/naming - requires loop ?

martin_mueller — Tue, 22 Jul 2014 02:17:03 GMT

You need more karma to do that, but I can.

Re: Custom field for numbering/naming - requires loop ?

crt89 — Tue, 22 Jul 2014 02:32:37 GMT

Thanks ! Now with this streamstats command I can change the numbers to specific values using the case command.

Re: Custom field for numbering/naming - requires loop ?

martin_mueller — Tue, 22 Jul 2014 02:36:17 GMT

Are you replacing the numbers with names? If so, consider placing the mapping number->name into a lookup file to not clog your search statement with the list and to ease reuse as well as maintenance.

Re: Custom field for numbering/naming - requires loop ?

crt89 — Tue, 22 Jul 2014 02:51:29 GMT

Oh yes didn't thought of that. Thanks again.