I have a header variable that I would like to attach to each event in a table.
Header variable, FY= 2017
table
bill | reason | FY
100 |restaurant | 2017
200 | gas | 2017
500 | water | 2017
\sourcetype=Bill |table bill reason|appendcols[search sourtype=Bill |fields FY] |table bill reason FY
The search above does not append the column to all events, it only appends it to the first row.
Is there a search or function that allows me to append the variable to all the events.
FYI, when I do eval tempVari="test"
, it attaches it to all events, but it doesn't work when it's a variable.
Try this
sourcetype=Bill |table bill reason|appendcols[search sourtype=Bill |fields FY] | filldown FY | table bill reason FY
Try this
sourcetype=Bill |table bill reason|appendcols[search sourtype=Bill |fields FY] | filldown FY | table bill reason FY
Thank you, that was exactly what i was looking for!
I am not sure whether I get your question right. But seems like you should look for eventstats command which appends a field to events returned by search. Refer to documentation below:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eventstats
i'm just trying to attach the variable that contains the year 2017 to all events. I'm not doing any calculation. the variable exist only in file header meaning it will only be in one event.