Custom field for numbering/naming - requires loop ?

[crt89]

Hi Good day Splunkers,

I was stuck on this simple problem. I want to make a field for my numbering/naming. I believe this can be attain by EVAL command. What I was trying to do is I have to show a table that consist of 11 results. I want to make a field before to it that indicates its name/number. Like 1 for row 1, then 2 for row 2

example:

name - result

1 - 200kb

2 - 250kb

3 - 300kb

4 - 350kb

5 - 400kb

How will my search be ? I was thinking a loop with eval but don't know where to start

Thanks,

[martin_mueller · Accepted solution]

Are you by chance looking for this?

... | streamstats count as name

[crt89]

Oh yes didn't thought of that. Thanks again.

[martin_mueller]

Are you replacing the numbers with names? If so, consider placing the mapping number->name into a lookup file to not clog your search statement with the list and to ease reuse as well as maintenance.

[crt89]

Thanks ! Now with this streamstats command I can change the numbers to specific values using the case command.

[martin_mueller]

You need more karma to do that, but I can.

[crt89]

@martin_mueller Wow thanks, this is what I need. Now how can I make your comment as an answer.

[martin_mueller]

I don't really understand your question, but you can do eval loops with foreach: http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchReference/foreach