Splunk Search

Add a row to end of table

simonattardGO
Path Finder

Hi,

I am running a scheduled search to output some logs to a file. Now I would like to add an extra line to the end of each file, so that it acts as a footer for the file. I.e. I want to add the words " END OF FILE" to the end of each file.

Which is the best way to do this?

Thanks a lot!

Tags (2)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

Assuming your search looks like this:

<my search here> | stats count by param1, param2, param3

Here is a quick way to do it:

<my search here> | stats count by param1, param2, param3 | append [|stats count |eval count="END OF FILE"]

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

View solution in original post

_d_
Splunk Employee
Splunk Employee

Assuming your search looks like this:

<my search here> | stats count by param1, param2, param3

Here is a quick way to do it:

<my search here> | stats count by param1, param2, param3 | append [|stats count |eval count="END OF FILE"]

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...