Splunk Search

Add value on a column without csv input file

Lucie99
Explorer

Hi everyone,

I need to put in these fix values on the Interval_tolerance column. Has somebody an idea ?

 

Thanks

Capture.PNG

Labels (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

Just do this in each of the sections of your search (replacing the ... by the respective value):

| eval Interval_tolerance = ...

Also, your search can be simplified a lot by doing both avg and stdev calculations in 1 go instead of the "appendcols"

| stats avg(Moy) as AV stdev(Moy) as SD by Debit

View solution in original post

FrankVl
Ultra Champion

Just do this in each of the sections of your search (replacing the ... by the respective value):

| eval Interval_tolerance = ...

Also, your search can be simplified a lot by doing both avg and stdev calculations in 1 go instead of the "appendcols"

| stats avg(Moy) as AV stdev(Moy) as SD by Debit

Lucie99
Explorer

Thanks !! It works

My code is also shorter !

 

Have a nice week

0 Karma

FrankVl
Ultra Champion

Looking at it once more, you can get rid of that whole "appends" approach, by simply removing the 'Debit=...' part from your search. Or replace it by Debit IN(a,b,c) if the data source contains other debit values which you want to ignore. Because the Debit field is the only thing that is different between the various appends bits, and you already do a 'by Debit' in your stats.

Then you can do the eval like this:

| eval Interval_tolerance = case(Debit=a,x,Debit=b,y,Debit=c,z)

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...