https://community.splunk.com/t5/Splunk-Search/eventnumber-field/m-p/28071#M5509 <P>The only way I know is to do this:<BR /> <CODE>index=_internal | eval acc=1 | accum acc as event_number | table _time _raw event_number</CODE></P> Thu, 08 Nov 2012 16:13:42 GMT dart 2012-11-08T16:13:42Z https://community.splunk.com/t5/Splunk-Search/eventnumber-field/m-p/28070#M5508 <P>Hello<BR /> Is there any way to get a field that would just be the number of the event? <BR /> like this?<BR /> <A href="http://tinypic.com/r/2cbuxl/6">http://tinypic.com/r/2cbuxl/6</A><BR /> thanks</P> Thu, 08 Nov 2012 15:58:28 GMT https://community.splunk.com/t5/Splunk-Search/eventnumber-field/m-p/28070#M5508 halperkins 2012-11-08T15:58:28Z https://community.splunk.com/t5/Splunk-Search/eventnumber-field/m-p/28071#M5509 <P>The only way I know is to do this:<BR /> <CODE>index=_internal | eval acc=1 | accum acc as event_number | table _time _raw event_number</CODE></P> Thu, 08 Nov 2012 16:13:42 GMT https://community.splunk.com/t5/Splunk-Search/eventnumber-field/m-p/28071#M5509 dart 2012-11-08T16:13:42Z