Refine your search:

Is there a way to report on the position of an event relative to the rest of the events in the result set?

For example, if I have five events in my result set, is there a way to display each event along with the position number relative in time to the other events, kind of like showing the ordering or row number?

Like this:

User     Row_Position
----     ------------
Eric     1
Greg     2
Gerald   3
Ledio    4
Mick     5

where the event containing the User=Eric is the earliest in time, the one with User=Greg is second one in time after that one, the event with User=Gerald is the next event in time after that one, etc.

BTW, when I create a table with my search, I notice a grayed-out row number on the far left side of the table in the search results page. Can I reference that? If so, what is the name of that field?

asked 22 May '10, 02:33

maverick's gravatar image

maverick ♦
2.6k6574
accept rate: 14%


One Answer:

When viewing returned events (but not results) there is a field _serial that is returned with each event. The field is the zero-based index of the event within the original set of returned events (before other commands are run against the set).

Results, which are the results of stats, chart, or timechart commands will not have such a field, as those will only have the fields you are summarizing. You could add such a field once your results are complete with | eval c=1 | accum c or | streamstats count as c commands though.

link

answered 22 May '10, 05:30

gkanapathy's gravatar image

gkanapathy ♦
26.3k1622
accept rate: 42%

edited 25 May '10, 12:44

Cool. The accum command did the trick. Exactly what I needed. Thanks!

(25 May '10, 04:59) maverick ♦
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×1,088
×130
×38
×6

Asked: 22 May '10, 02:33

Seen: 645 times

Last updated: 25 May '10, 12:44

Copyright © 2005-2012 Splunk, Inc. All rights reserved.