Reporting
Highlighted

[ adding row numbers to scheduled save search]

Builder

I have a saved search which lists results in this format

Field1 Field 2 Field 3
A aa aaa
B bb bbb

When I schedule a saved search and schedule it to send out a report via email, I need for the final report to contain row numbers as well - so its readable - preferably as the FIRST column (in the extracted csv -- or the inline format - we get to pick from either of these two options)

I would I do that ?

0 Karma
Highlighted

Re: [ adding row numbers to scheduled save search]

Splunk Employee
Splunk Employee

You can use streamstats. To the search, add:

| streamstats count as row
| table row Field1 Field2 Field3

View solution in original post

Highlighted

Re: [ adding row numbers to scheduled save search]

Builder

that worked like a charm ! thanks

0 Karma
Highlighted

Re: [ adding row numbers to scheduled save search]

Ultra Champion
0 Karma