Hi Good day Splunkers,
I was stuck on this simple problem. I want to make a field for my numbering/naming. I believe this can be attain by EVAL command. What I was trying to do is I have to show a table that consist of 11 results. I want to make a field before to it that indicates its name/number. Like 1 for row 1, then 2 for row 2
example:
name - result
1 - 200kb
2 - 250kb
3 - 300kb
4 - 350kb
5 - 400kb
How will my search be ? I was thinking a loop with eval but don't know where to start
Thanks,
Are you by chance looking for this?
... | streamstats count as name
Oh yes didn't thought of that. Thanks again.
Are you replacing the numbers with names? If so, consider placing the mapping number->name into a lookup file to not clog your search statement with the list and to ease reuse as well as maintenance.
Thanks ! Now with this streamstats command I can change the numbers to specific values using the case command.
You need more karma to do that, but I can.
@martin_mueller Wow thanks, this is what I need. Now how can I make your comment as an answer.
I don't really understand your question, but you can do eval
loops with foreach
: http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/foreach