Splunk Search

Display row numbers in output

efelder0
Communicator

I am indexing a CSV file into Splunk and wish to display the row number in a seperate column called 'row count'.

Example:

Field 1 Field 2 Row Count Field 3
blah blah 1 blah
blah blah 2 blah
blah blah 3 blah

What is the best method to achieve this?

Thanks.

Tags (2)

sanderdenheijer
Explorer

Add ... | streamstats count as "Row Count" to your search

efelder0
Communicator

Would displayRowNumbers work here? If so, how would it be configured in my search query?

0 Karma

MuS
Legend

Hi efelder0,

you can set this in viewstates.conf or in your XML with this option:

<option name="displayRowNumbers">true</option>

This will work in the recent Splunk releases.

0 Karma

wrangler2x
Motivator

Adding to /opt/splunk/etc/apps/search/local/viewstates.conf does not seem to do anything in the search app.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...