All Apps and Add-ons

How do I add a static column to search results?

jsights
New Member

I have a search that is pulling the number of times a service makes a call to an operation per hour. I have the base search working properly and would now like to add a static column that shows the SLA for each operation, but I am unsure how to do that and would appreciate some guidance.

Thanks!

loggingAppId=APPNAME|eval callingAppAndOperation=callingAppId.".".loggingOperationName |bin _time span=1h |stats count As HourlyTotal by _time, callingAppAndOperation |sort -HourlyTotal |dedup callingAppAndOperation |sort callingAppAndOperation
Tags (1)
0 Karma

DavidHourani
Super Champion

Hey t@jsights,

You should either use a csv file as a lookup or kvstore to list all your static SLAs per operation. Then use the lookup command like this :

loggingAppId=APPNAME|eval callingAppAndOperation=callingAppId.".".loggingOperationName |bin _time span=1h |stats count As HourlyTotal by _time, callingAppAndOperation |sort -HourlyTotal |dedup callingAppAndOperation |sort callingAppAndOperation | lookup callingAppAndOperation yourLookupDefintionName OUTPUTNEW SLA

Cheers,
David

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@jsights,

If you have different SLA for each type operation, try adding them into a lookup file and use it in your search.

i.e.
1. Create a look up table with Operation, SLA
2. Add the lookup to your search

Reference : https://docs.splunk.com/Documentation/Splunk/7.2.0/Knowledge/Aboutlookupsandfieldactions

Happy Splunking!
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...