Dashboards & Visualizations

Unable to output "index" field in Splunk table

POR160893
Builder

Hi,

I have a query that is searching over 4 different indexes (AIBA, AIBC, AIBP, AIBX) as follows:

index=AIB* "Windows" EventCode="*"

| stats count as NumOfLogs by dvc_NodeName
| sort - NumOfLogs
| eval Host = dvc_NodeName
| table Host , NumOfLogs, index

However, I need one of the fields on the outputted table to be "Index" but nothing is currently outputted in my current query.


Can you please help?


Thanks as always!



Labels (4)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @POR160893 ,

as @ITWhisperer said, after s stats command you have only the fields in the stats command.

If you want index, you have to add it to the stats, something like this:

index=AIB* "Windows" EventCode="*"
| stats values(index) AS index count AS NumOfLogs BY dvc_NodeName
| sort - NumOfLogs
| eval Host = dvc_NodeName
| table Host NumOfLogs index

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @POR160893 ,

as @ITWhisperer said, after s stats command you have only the fields in the stats command.

If you want index, you have to add it to the stats, something like this:

index=AIB* "Windows" EventCode="*"
| stats values(index) AS index count AS NumOfLogs BY dvc_NodeName
| sort - NumOfLogs
| eval Host = dvc_NodeName
| table Host NumOfLogs index

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust

The stats command reduces the fields to NumOfLogs and dvc_NodeName i.e index is no longer available beyond that point

Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...