addinfo
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
addinfo
Synopsis
Add fields that contain common information about the current search.
Syntax
| addinfo
Description
Adds global information about the search to each event. Currently the following fields are added:
info_min_time - the earliest time bound for the search
info_max_time - the latest time bound for the search
info_search_id - query id of the search that generated the event
info_search_time - time when the search was executed.
Examples
Example 1: Add information about the search to each event.
... |addinfo
See also
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.