Splunk Search

How to add an additional dummy row to a table?

tromero3
Path Finder

I have a search that outputs a table with two columns, one for log source one for total count (using stats count).

I'd like to add additional rows to the table where I can enter a custom field name for the "Log Source" column,  and then the total count column will be empty for that row. This will be for exporting the results of the table to CSV and the additional rows I will be adding will be empty so I can enter whatever value I want in the Total Count column and save it. 

So, this is how I would want it to look after the search is run (where Custom1 and Custom2 are the field names of the empty rows that I will be adding). 

Is this possible and how would I go about it? Thank you!

Log Source      Total Events
A                          20
B                          100
C                          50
Custom1
Custom2

Current query: 

 

index=A or index=B or index=C 
| eval "Log Source"=case(index == "A", "indexA", index == "B", "indexB", index == "C", "IndexC")
| stats count by "Log Source"
| append [| makeresults | eval indexA="", indexB="", indexC="" | table indexA indexB indexC | transpose column_name="Log Source" ]
| stats max(count) AS count BY "Log Source"
| fillnull value=0 count

 

Labels (2)
Tags (2)
0 Karma
1 Solution

tromero3
Path Finder

Thank you.  I played around with it but could not get appendpipe to work properly. I was able to add the additional rows by using my existing search and adding the values within the append search ("TEST" below ). 

index=A or index=B or index=C 
| eval "Log Source"=case(index == "A", "indexA", index == "B", "indexB", index == "C", "IndexC")
| stats count by "Log Source"
| append [| makeresults | eval indexA="", indexB="", indexC="", TEST="" | table indexA indexB indexC TEST | transpose column_name="Log Source" ]
| stats max(count) AS count BY "Log Source"
| fillnull value=0 count

 

View solution in original post

0 Karma

to4kawa
Ultra Champion

try appendpipe

tromero3
Path Finder

Thank you.  I played around with it but could not get appendpipe to work properly. I was able to add the additional rows by using my existing search and adding the values within the append search ("TEST" below ). 

index=A or index=B or index=C 
| eval "Log Source"=case(index == "A", "indexA", index == "B", "indexB", index == "C", "IndexC")
| stats count by "Log Source"
| append [| makeresults | eval indexA="", indexB="", indexC="", TEST="" | table indexA indexB indexC TEST | transpose column_name="Log Source" ]
| stats max(count) AS count BY "Log Source"
| fillnull value=0 count

 

0 Karma
Get Updates on the Splunk Community!

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...