topic Re: How to enumerate the events in my search results? in Splunk Search

How to enumerate the events in my search results?

maverick — Mon, 04 Aug 2014 15:05:41 GMT

When I view my log file in my favorite text editor(s), I can switch to a mode where the editor lists out the line numbers long the side.

After I search my events in Splunk, is there a similar way to enumerate the events so that I get a line number next to each event?

Re: How to enumerate the events in my search results?

maverick — Mon, 04 Aug 2014 15:11:29 GMT

You can use the accum command to simulate this sort of effect.

Like this:

| eval n = 1 | accum n

which will create a new field called "n" that will contain the incremental event number in the order of your search results.

you can then list out the events and this line number in a table like this:

| table n _raw

Also, if you want to list it out like you would see in a text editor, where the earliest event is at the top, and the latest event is at the bottom, then use the reverse command first, like this:

| reverse | eval n = 1 | accum n | table n _raw

Re: How to enumerate the events in my search results?

woodcock — Thu, 17 Sep 2015 15:04:49 GMT

Also, there is an internal field called _serial that should already be there (but it is semi-invisible) but it starts at 0 instead of 1. Try this (should be the quickest and most efficient solution):

... | eval serial=_serial | table serial _raw