Splunk Search

Custom field for numbering/naming - requires loop ?

crt89
Communicator

Hi Good day Splunkers,

I was stuck on this simple problem. I want to make a field for my numbering/naming. I believe this can be attain by EVAL command. What I was trying to do is I have to show a table that consist of 11 results. I want to make a field before to it that indicates its name/number. Like 1 for row 1, then 2 for row 2

example:

name - result

1 - 200kb

2 - 250kb

3 - 300kb

4 - 350kb

5 - 400kb

How will my search be ? I was thinking a loop with eval but don't know where to start

Thanks,

Tags (2)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Are you by chance looking for this?

... | streamstats count as name

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Are you by chance looking for this?

... | streamstats count as name

crt89
Communicator

Oh yes didn't thought of that. Thanks again.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are you replacing the numbers with names? If so, consider placing the mapping number->name into a lookup file to not clog your search statement with the list and to ease reuse as well as maintenance.

crt89
Communicator

Thanks ! Now with this streamstats command I can change the numbers to specific values using the case command.

martin_mueller
SplunkTrust
SplunkTrust

You need more karma to do that, but I can.

crt89
Communicator

@martin_mueller Wow thanks, this is what I need. Now how can I make your comment as an answer.

martin_mueller
SplunkTrust
SplunkTrust

I don't really understand your question, but you can do eval loops with foreach: http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/foreach

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...