Archive

How to calculate and add missing field to source?

user93
Communicator

source A : filename,title,version,type,date
source B: filename,date

I want to compute the title field for source b and output that into my data where the file name has the same value for source A and B.

Goal:  source=b | table _time,filename,title

Where source b does not include the title in the _raw but source a has the same filename and also includes title in the _raw.

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this:

(source=A OR source=B) | stats latest(_time) as _time, latest(title) as title by filename | table _time, filename, title
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this:

(source=A OR source=B) | stats latest(_time) as _time, latest(title) as title by filename | table _time, filename, title
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

user93
Communicator

This works, but what I really want is for the events to become a new field in the search, because now I cannot add other fields lost to the stats pipe. For example, I want: | table _time,filename,title,version,w_day

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To avoid losing fields to stats, include them in stats. ... | stats latest(_time) as _time, latest(title) as title latest(version) as version, latest(w_day) as w_day by filename | ....

---
If this reply helps you, an upvote would be appreciated.

user93
Communicator

Thanks @richgalloway. I thought enough to do that, but my mistake was not carrying the by clause to the end. Makes sense to me now. Thank you.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!