Add Date to report

[gjsmarsh]

Hi There.

I'm fairly new to Splunk reporting.  I have inherited this fairly simple report.

index=* Level=ERROR | stats count(index) by index | sort indexTotal desc

That just shows a count of errors by index.  

I need to add another column to the report that just shows the current date.

Thanks in advance for any help!

[bowesmana · Accepted solution]

If you just want to add the current date/time to the report you can just add the following line after the stats, which will set the _time column to the current time.

| eval _time=now()

 Note that your existing search is a little wrong in that the stats count doesn't give the aggregation the name you are using in the sort command. I suspect you meant

index=* Level=ERROR
| stats count as Total by index 
| sort index Total desc
| eval _time=now()

Couple of points

1. Do you want to sort first by index then by total - could be that your largest count of errors would be at the bottom. Maybe this, which would give you descending total but ascending index order

| sort - Total, + index

2. Also not that using wildcard on index will not always give you ALL indexes, as that will depend on your permissions, but it will also not return any of the internal indexes, prefixed with _ 

Hope this helps.

[gjsmarsh]

Thanks so much!  I need to do a tutorial or something on Splunk Queries but this gets me moving out the door.

And yeah I had removed the alias from the actual query and forgot to add it in the sample I shared.  Thanks also for pointing that out 🙂