Splunk Search

How to add a column to the results table based on an existing field?

ivtashev
New Member

Hello:

I am trying to add a column to the results table, the reason for this is so that I can then use that value for populating a token. Here is the search:

1.  <search here> 
2.  | chart latest(Data) AS "Data" over Time by Thread
3.  | sort + Time 
4.  | eval Goal=25 
5.  | eval Min=18 
6.  | eval LastPrimer=Primer

The results table of this looks like:

  Time   Goal    Min             data1    data2    data3
    0    25          18                   29.2728     26.2105   14.8187
    1    25          18                 29.6007   28.9153   14.9330

I want to also see LastPrimer in the results table. Primer is an indexed field.

Tags (4)
0 Karma

TISKAR
Builder

Hello,

You can use appendcols command:

<search here> 
  | chart latest(Data) AS "Data" over Time by Thread
  | sort + Time 
  | eval Goal=25 
  | eval Min=18 
  | appendcols [search <search here> | eval LastPrimer=Primer | table LastPrimer`]

Simple Example (You can past this request in your bare search):

  index="_internal" 
    | bin _time span=1d
    | stats count by _time
    | appendcols 
        [search index="_internal" 
        | table log_level 
        | dedup log_level]
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...