Splunk Search

Adding a blank row to the output

arunkuriakose0
Engager

Hi Team

 

How can we add a blank row to the output. I have a search followed by some outputs in table format. I want to add a blank row in start or any where in the column .

index=*  Event Code=4624 Logotype=8  earliest=-d@d latest=@d | top user | appendpipe [|head 1 | for each * [eval new=""]] 

 

Tried something like this which gave me a new row with name new. I just want to add a blank row in search results. Can some one help?

Thanks in advance

 

Labels (1)
0 Karma

tscroggins
Influencer

@arunkuriakose0 

appendpipe [ | makeresults ]

will add a row/event with only a _time value.

Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...