Search command: addinfo

Summary indexing uses the addinfo command to add fields containing general information about the current search to events going into a summary index. You can also use | addinfo in any search to add general information (about the current search) to the search results. This is useful if you want to build and test searches and reports on search results before using summary indexing.

Currently, addinfo adds the following fields to each result:

info_min_time: The earliest time bound of the search.
info_max_time: The latest time bound of the search.
info_search_id: The query_id of the search that generated the event.
info_search_time: The search execution time.

Note: The fields that addinfo adds are defined in savedsearches.conf. Currently, you can't customize the fields addinfo adds to the search results.

Syntax

addinfo

Arguments

None.

Examples

Splunk Web:
This example searches Web server data and builds a report based on client IPs. It then adds fields containing general search information to the search results, returns a list sorted by unique IP addresses and by what search each event came from (query_ID).

host=webserver1 eventtype=banner_access NOT eventtypetag=bot NOT eventtypetag=images NOT eventtype=splunk_IPs NOT eventtype=10dot_IP_range NOT eventtypetag=invalid_page | stats distinct_count(clientip) as uniqueIPs,  max(_time), min(_time) | eval site="update_banners" | addinfo | sort uniqueIP, info_search_id

This example searches Web server data for raw downloads and adds global data to the search results.

"eventtypetag=download" NOT eventtypetag=bot NOT eventtypetag=internal | addinfo

Previous: crawl | Next: Search command: collect

Comments

No comments have been submitted.