I only just found out about the existence of the internal _serial
field which should be equal to the row-number less 1 (e.g. first row has _serial
value of 0, second row has _serial
value of 1, etc.) but no matter what I do, I cannot get examples that have been posted here before that use _serial
to work. What is the deal with _serial
? When did it go away and was it deliberate or a bug?
Based on the comment by @acharlieh I went back and played around and have concluded that _serial
only exists for the first set of events that are returned (whatever is under the events
tab). Evidently _serial
is destroyed by doing any other commands which modify the initial result-set in any way, never to be recalculated. This is extremely unfortunate since this makes _serial
pretty much useless. My situation was that I was hoping to use it after doing a stats
command but it is gone by then. To remedy this, I regenerated _serial
myself like this instead:
... | streamstats current=f count AS _serial
Based on the comment by @acharlieh I went back and played around and have concluded that _serial
only exists for the first set of events that are returned (whatever is under the events
tab). Evidently _serial
is destroyed by doing any other commands which modify the initial result-set in any way, never to be recalculated. This is extremely unfortunate since this makes _serial
pretty much useless. My situation was that I was hoping to use it after doing a stats
command but it is gone by then. To remedy this, I regenerated _serial
myself like this instead:
... | streamstats current=f count AS _serial
I upgraded a 6.2.1 instance to 6.2.3 and I'm able to still see _serial
and other hidden fields in results doing a search like index=_internal | fields - _raw | rename _* as *_x | table *_x
That said, _serial and other hidden fields can be altered and destroyed by transforming commands. So the question is what examples are you trying that seem to not be working?
I never heard of this field. What is the notion of row number in splunk ?
was it for CSV files ? Because this is gone since the 6.* and the INDEXED_EXTRACTIONS.
In case the field is there but hidden, try :
- try to cast it in a field with an eval first.
<my search> | eval serial=_serial | table serial _raw
or maybe try to add it to the fields.conf