Splunk Search

Add a row to end of table

simonattardGO
Path Finder

Hi,

I am running a scheduled search to output some logs to a file. Now I would like to add an extra line to the end of each file, so that it acts as a footer for the file. I.e. I want to add the words " END OF FILE" to the end of each file.

Which is the best way to do this?

Thanks a lot!

Tags (2)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

Assuming your search looks like this:

<my search here> | stats count by param1, param2, param3

Here is a quick way to do it:

<my search here> | stats count by param1, param2, param3 | append [|stats count |eval count="END OF FILE"]

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

View solution in original post

_d_
Splunk Employee
Splunk Employee

Assuming your search looks like this:

<my search here> | stats count by param1, param2, param3

Here is a quick way to do it:

<my search here> | stats count by param1, param2, param3 | append [|stats count |eval count="END OF FILE"]

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!