Splunk Search

adding comments to search results rows

bbouch
Explorer

I would like to know if it's possible to add a column to the end of my search results with an editable text box in it, so I can add comments to specific rows in my output before printing or emailing the results off to other people. The results of my query can change wildly each time I run it, so adding a static column is not an option for this particular scenario.

For example, I have a query that shows the top 10 exceptions for a given application in the specified timeframe. I'd like to be able to add a comment for each exception that gives a brioef explanation of the issue and/or what has been done to address it.

so, instead of seeing a report that has

nameNotFoundException          1182
Bad Result From Customer Lookup  75

I want to be able to add comments to the end of each result so it looks something like the following when printed/sent off to someone:

nameNotFoundException           1182         Fix scheduled for Oct 22 release
Bad Result From Customer Lookup   75         Ticket 1234 opened with Marketing Run Team 7/30

Is this kind of customization available from within Splunk? I know I can export to a .csv and do it there, but I need to repeat this process multiple times for different teams, so I am looking for a way to streamline it a little from that.

Thoughts/Suggestions?

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

If the comment supposed to be always the same per category :
the best thing seems to create a lookup on a field (like error field), that has 2 columns "error", "comment"
and apply the lookup at the end of your search to add the comment.
Then you just have to maintain the lookup table.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...