Splunk Search

eval a new field base on a search result

gfs2277
New Member

hey ninjas,

i have a search result like the following:

error_code1 42
error_code2 55
error_code3 62
error_code4 17

i want to append a colum at the right side
the value of the colum is base on a search result ( such as index=nijia | stats count)
i expect it to looked like the this:

error_code1 42 100
error_code2 55 100
error_code3 62 100
error_code4 17 100

i think i should use "eval" to get the new colum , but i do not know how to eval a new field base on a search result
do you have any ideas?

Tags (2)
0 Karma

landen99
Motivator

Here are a couple of other options:

| appendcol [subsearch]

as well, but this will only match the values line by line in the order that the results appear from the subsearch. Or you could use

| join field1 [subsearch]

to match the results to the base search as they match on field1.

tpask
Engager

| appendcols [ search .... ] works

0 Karma

somesoni2
Revered Legend
Your base search giving error_code, count | eval newCol=[ search index=ninja |stats count | return $count]
0 Karma

ruman_splunk
Splunk Employee
Splunk Employee

This didn't work for me, but this did:

| eval [ | rest splunk_server=local /services/server/info | return host ]
0 Karma

MuS
SplunkTrust
SplunkTrust
0 Karma

gfs2277
New Member

please note the search ( what the eval base on ) just return single value ( not multi-row )
so appendcols will not works in this case

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...