How to enumerate the events in my search results?

[maverick]

When I view my log file in my favorite text editor(s), I can switch to a mode where the editor lists out the line numbers long the side.

After I search my events in Splunk, is there a similar way to enumerate the events so that I get a line number next to each event?

[woodcock]

Also, there is an internal field called _serial that should already be there (but it is semi-invisible) but it starts at 0 instead of 1. Try this (should be the quickest and most efficient solution):

... | eval serial=_serial | table serial _raw

[maverick · Accepted solution]

You can use the accum command to simulate this sort of effect.

Like this:

| eval n = 1 | accum n 

which will create a new field called "n" that will contain the incremental event number in the order of your search results.

you can then list out the events and this line number in a table like this:

| table n _raw

Also, if you want to list it out like you would see in a text editor, where the earliest event is at the top, and the latest event is at the bottom, then use the reverse command first, like this:

| reverse | eval n = 1 | accum n | table n _raw