Splunk Search

How to enumerate the events in my search results?

Splunk Employee
Splunk Employee

When I view my log file in my favorite text editor(s), I can switch to a mode where the editor lists out the line numbers long the side.

After I search my events in Splunk, is there a similar way to enumerate the events so that I get a line number next to each event?

1 Solution

Splunk Employee
Splunk Employee

You can use the accum command to simulate this sort of effect.

Like this:

| eval n = 1 | accum n 

which will create a new field called "n" that will contain the incremental event number in the order of your search results.

you can then list out the events and this line number in a table like this:

| table n _raw

Also, if you want to list it out like you would see in a text editor, where the earliest event is at the top, and the latest event is at the bottom, then use the reverse command first, like this:

| reverse | eval n = 1 | accum n | table n _raw

View solution in original post

Esteemed Legend

Also, there is an internal field called _serial that should already be there (but it is semi-invisible) but it starts at 0 instead of 1. Try this (should be the quickest and most efficient solution):

... | eval serial=_serial | table serial _raw
0 Karma

Splunk Employee
Splunk Employee

You can use the accum command to simulate this sort of effect.

Like this:

| eval n = 1 | accum n 

which will create a new field called "n" that will contain the incremental event number in the order of your search results.

you can then list out the events and this line number in a table like this:

| table n _raw

Also, if you want to list it out like you would see in a text editor, where the earliest event is at the top, and the latest event is at the bottom, then use the reverse command first, like this:

| reverse | eval n = 1 | accum n | table n _raw

View solution in original post