Unable to output "index" field in Splunk table

[POR160893]

Hi,

I have a query that is searching over 4 different indexes (AIBA, AIBC, AIBP, AIBX) as follows:

index=AIB* "Windows" EventCode="*"

| stats count as NumOfLogs by dvc_NodeName
| sort - NumOfLogs
| eval Host = dvc_NodeName
| table Host , NumOfLogs, index

However, I need one of the fields on the outputted table to be "Index" but nothing is currently outputted in my current query.


Can you please help?


Thanks as always!

[gcusello · Accepted solution]

Hi @POR160893 ,

as @ITWhisperer said, after s stats command you have only the fields in the stats command.

If you want index, you have to add it to the stats, something like this:

index=AIB* "Windows" EventCode="*"
| stats values(index) AS index count AS NumOfLogs BY dvc_NodeName
| sort - NumOfLogs
| eval Host = dvc_NodeName
| table Host NumOfLogs index

Ciao.

Giuseppe

[ITWhisperer]

The stats command reduces the fields to NumOfLogs and dvc_NodeName i.e index is no longer available beyond that point