Splunk Search

eval a new field base on a search result

gfs2277
New Member

hey ninjas,

i have a search result like the following:

error_code1 42
error_code2 55
error_code3 62
error_code4 17

i want to append a colum at the right side
the value of the colum is base on a search result ( such as index=nijia | stats count)
i expect it to looked like the this:

error_code1 42 100
error_code2 55 100
error_code3 62 100
error_code4 17 100

i think i should use "eval" to get the new colum , but i do not know how to eval a new field base on a search result
do you have any ideas?

Tags (2)
0 Karma

landen99
Motivator

Here are a couple of other options:

| appendcol [subsearch]

as well, but this will only match the values line by line in the order that the results appear from the subsearch. Or you could use

| join field1 [subsearch]

to match the results to the base search as they match on field1.

tpask
Engager

| appendcols [ search .... ] works

0 Karma

somesoni2
Revered Legend
Your base search giving error_code, count | eval newCol=[ search index=ninja |stats count | return $count]
0 Karma

ruman_splunk
Splunk Employee
Splunk Employee

This didn't work for me, but this did:

| eval [ | rest splunk_server=local /services/server/info | return host ]
0 Karma

MuS
Legend
0 Karma

gfs2277
New Member

please note the search ( what the eval base on ) just return single value ( not multi-row )
so appendcols will not works in this case

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...