Splunk Search

How to write a search to append a header variable to all events from the same source?

Path Finder

I have a header variable that I would like to attach to each event in a table.

Header variable, FY= 2017

table

bill | reason | FY
100 |restaurant | 2017
200 | gas | 2017
500 | water | 2017

\sourcetype=Bill |table bill reason|appendcols[search sourtype=Bill |fields FY]  |table bill reason FY

The search above does not append the column to all events, it only appends it to the first row.
Is there a search or function that allows me to append the variable to all the events.

FYI, when I do eval tempVari="test", it attaches it to all events, but it doesn't work when it's a variable.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this

sourcetype=Bill |table bill reason|appendcols[search sourtype=Bill |fields FY] | filldown FY | table bill reason FY
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Try this

sourcetype=Bill |table bill reason|appendcols[search sourtype=Bill |fields FY] | filldown FY | table bill reason FY
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Path Finder

Thank you, that was exactly what i was looking for!

0 Karma

Legend

I am not sure whether I get your question right. But seems like you should look for eventstats command which appends a field to events returned by search. Refer to documentation below:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventstats

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Path Finder

i'm just trying to attach the variable that contains the year 2017 to all events. I'm not doing any calculation. the variable exist only in file header meaning it will only be in one event.

0 Karma