Reporting

[ adding row numbers to scheduled save search]

asarolkar
Builder

I have a saved search which lists results in this format

Field1 Field 2 Field 3
A aa aaa
B bb bbb

When I schedule a saved search and schedule it to send out a report via email, I need for the final report to contain row numbers as well - so its readable - preferably as the FIRST column (in the extracted csv -- or the inline format - we get to pick from either of these two options)

I would I do that ?

0 Karma
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use streamstats. To the search, add:

| streamstats count as row
| table row Field1 Field2 Field3

View solution in original post

sloshburch
Splunk Employee
Splunk Employee
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use streamstats. To the search, add:

| streamstats count as row
| table row Field1 Field2 Field3

asarolkar
Builder

that worked like a charm ! thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...