Splunk Search

How do I bring serial number in splunk

abhayneilam
Contributor

Hi,

I have four line result as follows:

value1
value2
value3
value4

but I want the serial no. should be before each line as follows:

1 value1
2 value2
3 value3
4 value

When I export in .csv or .xlsx format. I should get my result along with serial no.

Please help

Tags (4)

jawaharas
Motivator

You can try 'Format'->'Row Numbers'.


jawaharas_0-1609895521463.png

 

 

0 Karma

Gilberto_Castil
Splunk Employee
Splunk Employee

If I understand your question, you want to have an incremental row number paired with your results. If this is the case, this is similar to this question and a similar answer applies.

The Splunk command you are looking for here is accum -which increments a field value by one.

index=blah sourcetype=blah blah | eval SNO=1 | accum SNO | table SNO Field1 

It should be noted, however, that Splunk will show row numbers in a table by default. The numbering will begin at one (1).

srizan
Path Finder

This definitely helped me!

0 Karma

yannK
Splunk Employee
Splunk Employee

Do you mean serial order or serial number ?

In Splunk the the order is chronological, based on the timestamp.
Or i you want you own order, in your logs, add a columns with an incrementing number.

abhayneilam
Contributor

I want to add a separate column which would contain the serial number with the incrementing number.

Please help me regarding this !!

Thanks in Advance
Abhay

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...