Getting Data In

Can I make a field which contains the number of the entry, as a substitute for timestamp?

akcyril
New Member

I would like to experiment with entries in which time is mentioned as 1,2,3, .... , n; where the nth entry is the latest. Is this possible?

0 Karma

sundareshr
Legend

Look at streamstats command. You can use that to add a "counter" in reverse order to your events. Something like this may work base search | reverse | streamstats count

http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Streamstats

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...