set a value at search time

[sbsbb]

I made a Union with APPEND betwenn to search :

search1 APPEND [search2]

I want to have a field "source" that has a specific value, depending from the source query is there a way to do somthing like :

search1 source=1 | APPEND [search2 source=2]

and to have results like :

field1, field2, 1 (when comming from source1)
field1, field2, 2 (when comming from source2)

?

[Ayn · Accepted solution]

Sure. Have a look at eval which will do what you want.

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval

[sbsbb]

that exactly what I needed thank you