Splunk Search

How to calculate and add missing field to source?

user93
Communicator

source A : filename,title,version,type,date
source B: filename,date

I want to compute the title field for source b and output that into my data where the file name has the same value for source A and B.

Goal:  source=b | table _time,filename,title

Where source b does not include the title in the _raw but source a has the same filename and also includes title in the _raw.

Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try this:

(source=A OR source=B) | stats latest(_time) as _time, latest(title) as title by filename | table _time, filename, title
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Try this:

(source=A OR source=B) | stats latest(_time) as _time, latest(title) as title by filename | table _time, filename, title
---
If this reply helps you, Karma would be appreciated.

user93
Communicator

This works, but what I really want is for the events to become a new field in the search, because now I cannot add other fields lost to the stats pipe. For example, I want: | table _time,filename,title,version,w_day

0 Karma

richgalloway
SplunkTrust
SplunkTrust

To avoid losing fields to stats, include them in stats. ... | stats latest(_time) as _time, latest(title) as title latest(version) as version, latest(w_day) as w_day by filename | ....

---
If this reply helps you, Karma would be appreciated.

user93
Communicator

Thanks @richgalloway. I thought enough to do that, but my mistake was not carrying the by clause to the end. Makes sense to me now. Thank you.

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...