- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Help with forming a table with sourcename next...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I'm searching multiple sources in a single index and getting the results as a table. I want to display the sourcename next to the first column for each row. How can I do that ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try like this
index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local source | sort 0 - COL2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try like this
index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local source | sort 0 - COL2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
this is exactly what I was looking for.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local | sort 0 - COL2
If I just add
index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local, latest (source) as COL5 | sort 0 - COL2
or if you want to see ALL the source values in one go
index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local, values (source) as COL5 | sort 0 - COL2
Coming back to what @niketnilay is asking is source an auto discovered field or you want to extract a custom source field?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This is my sample search
index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local | sort 0 - COL2
and I want a new column appended with source values as second column.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You mean like this?
<base search> | table foo source ...
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes but
table "prior column names" source
shows empty column for source.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@charanramireddy, Are you saying the following works
<YourBaseSearch>
| table source foo
But revrsing the sequence does not?
<YourBaseSearch>
| table source foo
What type of data input is it? What is going to be the first column in the table? Are you able to see source names when you run your base search under interesting fields? What is the exact table command you are running?
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
not really claer what you want, can you give a sample of what your table looks like currently and how you would want it to appear?
New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...
Improve Data Pipelines Using Splunk Data Management
3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?
