topic Re: Add a new column,except "Time" "Event". in Splunk Search

Add a new column,except "Time" "Event".

dovelsh12223621 — Tue, 12 May 2015 12:23:54 GMT

I want to add a new column,just like host to default the search results display .You know the searchstring like "index=_internal “ will show us ：
Time Event

I want to add a new column,so the search results will display:
Time Host Event

Please,give me some advices,thanks.

Re: Add a new column,except "Time" "Event".

jeffland — Tue, 12 May 2015 12:29:42 GMT

If you want a table, use table with the columns you are interested in:

index=_internal | table _time host sourcetype

If you want the entire event, use

index=_internal | table _time host _raw

Re: Add a new column,except "Time" "Event".

dovelsh12223621 — Tue, 12 May 2015 12:58:12 GMT

Yeah ,I know table .However,the table have no friendly user interface.I am sorry with it,also.I want to the search results display .Just like "index=_internal “ will show us ,and add new column like (host).Please,help me.

Re: Add a new column,except "Time" "Event".

jeffland — Tue, 12 May 2015 14:49:05 GMT

Ah. Maybe the option to show those events as a table instead of a list is what you want. Under the green bars showing the count of results over time when you search for index=_internal, click on the leftmost option which should say "List" by default, next to "Format" and "20 per page". Select "Table" there instead of list, and you will see that besides the timestamp there are columns for all fields that are selected. If you do this and in the event sidebar select host and whichever other fields you are interested in, maybe this is what you need.

Although in a way, this is pretty much the same as table does.