can we display the S.no field along with my table command ?

[rakesh_498115]

Hi..

is it possible a field called SNO along with my search search results , which will old the serial no of events .i.e 0 ,1 ,2 ,,and so on..

i.e i need the following when i use the table command ..

SNO Field Field
0 data data
1 data data
2 data data
....
.
.
.

and so on..

how can i do this ??

please help..

[Gilberto_Castil · Accepted solution]

Hello,

If the field SNO does not exist, you can dynamically create it during search time. The Splunk command you are looking for here is accum -which increments a field value by one.

There is one small catch here, the command will not begin to increment if the field value starts with a zero. Nonetheless, there is a way around it. Here is a quick search that should help:

index=blah sourcetype=blah blah | eval SNO=1 | accum SNO | eval SNO=SNO-1 | table SNO Field1 Field2

It should be noted, however, that Splunk will show row numbers in a table by default. The numbering will begin at one (1).