Splunk Search

Can you help me with a search query using the table command?

Path Finder

Hi Team,

I have a query to segregate and provide the data in a table format in Splunk Enterprise.

index=xxx sourcetype="xyz" "ERROR" |table index, sourcetype, Level

In this search query now, i am getting a table format with index sourcetype and Level information in a perfect manner. But I also want to display in the table format the search query also i.e. (index=xxx sourcetype="xyz" "ERROR" )

So how can i get the data something like:

index  sourcetype level query
Tags (2)
0 Karma



Can you please try this search?

index=xxx sourcetype="xyz" "ERROR" 
| table index, sourcetype, Level 
| addinfo 
| map search=" | rest splunk_server=local count=0 /services/search/jobs | search sid=$info_sid$ | eval sourcetype=$sourcetype$,index=$index$, Level=$Level$| table index sourcetype Level title | rename title as query"

Here, I have used map. Ref:https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/map

I have tried with below sample search.

index="_internal" | stats count by sourcetype | addinfo | map search=" | rest splunk_server=local count=0 /services/search/jobs | search sid=$info_sid$ | eval sourcetype=$sourcetype$,count=$count$| table title sourcetype count"


0 Karma

Path Finder

The query seems to be not working fine as expected.

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...