Help with forming a table with sourcename next to the first column for each row?

[charanramireddy]

Hi,

I'm searching multiple sources in a single index and getting the results as a table. I want to display the sourcename next to the first column for each row. How can I do that ?

[somesoni2 · Accepted solution]

Try like this

 index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local source | sort 0 - COL2

[charanramireddy]

this is exactly what I was looking for.

[Sukisen1981]

index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local | sort 0 - COL2
If I just add
index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local, latest (source) as COL5 | sort 0 - COL2
or if you want to see ALL the source values in one go
index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local, values (source) as COL5 | sort 0 - COL2

Coming back to what @niketnilay is asking is source an auto discovered field or you want to extract a custom source field?

[charanramireddy]

This is my sample search

index=ssc | multikv forceheader=6 | stats latest(CQD) as COL1, latest(PQF) as COL2, latest(OIC) as COL3, latest(OUC) as COL4 by Local | sort 0 - COL2

and I want a new column appended with source values as second column.

[richgalloway]

You mean like this?

<base search> | table foo source ...

[charanramireddy]

yes but

table  "prior column names" source 

shows empty column for source.

[niketn]

@charanramireddy, Are you saying the following works

 <YourBaseSearch>
| table source foo

But revrsing the sequence does not?

 <YourBaseSearch>
| table source foo

What type of data input is it? What is going to be the first column in the table? Are you able to see source names when you run your base search under interesting fields? What is the exact table command you are running?

[Sukisen1981]

not really claer what you want, can you give a sample of what your table looks like currently and how you would want it to appear?