Adding a row count field (sequence number) to a record in the index time field extraction

[yuwtennis]

Hi!

I want to creae a index that has a sequence number field per record.

In props.conf , there is a field extraction option "EVAL-field name".

Would this be a option to implement a such function?

Thanks,
Yu

[sowings]

No, eval won't do what you want here.

What problem are you trying to solve? I can offer suggestions to get you closer to what you want, but only if I know where it is you're trying to go.

[sowings]

Since you mentioned that you're preparing this for "export" to another database system, is it that system that needs the sequence ID? If so, we could generate the sequence ID at search time when you're ready to send the data for export.

[yuwtennis]

I thought that best way is to put a number at the index-time
field extraction but it seems not to work.

[yuwtennis]

Hello sowings.

Thank you for the reply.

What I want to do is to create a table that contains
a sequence number

seq f1 f2 f3
1 1 2 3
2 4 5 6
3 1 2 3
4 1 2 3

Also, I am considering to input csv data from the external
application and every time splunk reads the data
I want this seq to count up
So , if following new data is gathered

new data
f1 f2 f3
7 8 9

It will be like,

seq f1 f2 f3
1 1 2 3
2 4 5 6
3 1 2 3
4 1 2 3
5 7 8 9

The reason I need this is I need to create csv file contains
seq which is needed for external application's database.