Splunk Search

Create an Own column in my query

exchanger
Path Finder

Hello,

I have a query (e.g. "....... " | stats count, avg(...)) and after that I get as result
Count avg
20        40

What I would like to have before that is a separate column that I can name myself.
So desired:
OwnColumn Count AVG
XYZ                 20           40

How can I include this in my query?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| stats count as Count, avg(DURATION)) as AVG
| eval OwnColumn="XYZ"
| fields OwnColumn, Count, AVG

View solution in original post

exchanger
Path Finder

thank you very much

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats count as Count, avg(DURATION)) as AVG
| eval OwnColumn="XYZ"
| fields OwnColumn, Count, AVG
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...