I have this query-
index=myIndex logRecordTypeX=1
(logName="abc" OR logName="def" OR logName="ghi" OR logName="jkl" OR logName="mno")
starttime="08/31/2010:00:00:00.000" endtime="08/31/2010:23:59:59.999" | fields logName, organizationId | eval logName=lower(logName) | chart count as pageViews over organizationId by logName limit=50 | addtotals fieldname=totalPageviews | sort –totalPageviews
I want to add another columns to my search results called Date ( it will display the same value in all rows- ie 8/31/2010). How can I do that?
I finally used this as a workaround(ie appending date to one of the column values)
index=myIndex logRecordTypeX=1 (logName="abc" OR logName="def" OR logName="ghi" OR logName="jkl" OR logName="mno") starttime="08/31/2010:00:00:00.000" endtime="08/31/2010:23:59:59.999" | fields logName, organizationId,_time | eval Time=strftime(_time,"%m/%d") | eval NewOid = organizationId+" "+Time | chart count as pageViews over NewOid by logName limit=50
If you want to hardcode the date here, you can just add | eval Date = "8/31/2010"
but I suppose you want to be more clever and have it be based on the search itself.
In that case you should add:
... | addinfo | eval Date = strftime(info_min_time, "%m/%d/%Y") | fields - info_*