Add a comment field to an event

[nate015]

A user would like to click on the down arrow to the left of an event and leave a comment. I think I have seen this demoed in ESS. Is there a simple way to implement it?

[Lowell · Accepted solution]

I don't know anything about the ESS app myself, but I think you may find the following discussions helpful:

• Does each Splunk event have a unique identifier?
• Correlate (and tag!) Splunk events with Change Control Tickets

---

A possible "hack" for annotating transactions (used in combination with the methods described in the above links):

... | transaction your-txn-options mvlist="splunk_server,index,_cd" | eval splunk_server=mvindex(splunk_server,0) | eval index=mvindex(index,0) | eval _cd=mvindex(_cd,0) | lookup mylookup splunk_server index _cd OUTPUT my_txn_note

This trick will only work if your transaction command is guaranteed to always have the exact same first event.

[gkanapathy]

You could use a concatencation of the _cd values as your key if you must, and split it to get your items back. It should be available via eval f=mvjoin(_cd,";") for example.

[Lowell]

Yeah. It sounds like the ability to annotate events (or transactions, in your specific case) is on the radar, but making splunk aware of your specific use case with an ER is certainly good idea. In the mean time, if your transaction events always start with the same event, you could do some filtering to make sure you always just select the first _cd value. It's kind of a hack, but the whole thing is a hack anyways...

[nate015]

Thanks for the links Lowell, unfortunately I don't think they will work for me since I'm using the "transaction" operator (which will have multiple _cd values).

What I'm doing is running a search that looks at all the commands logged by a user on a networking device and puts them into a single transaction. The user then needs to put an explanation and a ticket number to go along with the transaction. I'll open an enhancement request.