Splunk Search

Can you help me with a search query using the table command?

anandhalagarasa
Path Finder

Hi Team,

I have a query to segregate and provide the data in a table format in Splunk Enterprise.

index=xxx sourcetype="xyz" "ERROR" |table index, sourcetype, Level

In this search query now, i am getting a table format with index sourcetype and Level information in a perfect manner. But I also want to display in the table format the search query also i.e. (index=xxx sourcetype="xyz" "ERROR" )

So how can i get the data something like:

index  sourcetype level query
Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@anandhalagarasan

Can you please try this search?

index=xxx sourcetype="xyz" "ERROR" 
| table index, sourcetype, Level 
| addinfo 
| map search=" | rest splunk_server=local count=0 /services/search/jobs | search sid=$info_sid$ | eval sourcetype=$sourcetype$,index=$index$, Level=$Level$| table index sourcetype Level title | rename title as query"

Here, I have used map. Ref:https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/map

I have tried with below sample search.

index="_internal" | stats count by sourcetype | addinfo | map search=" | rest splunk_server=local count=0 /services/search/jobs | search sid=$info_sid$ | eval sourcetype=$sourcetype$,count=$count$| table title sourcetype count"

Thanks

0 Karma

anandhalagarasa
Path Finder

The query seems to be not working fine as expected.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...