Splunk® Enterprise

Search Reference

Acrobat logo Download manual as PDF


Splunk Enterprise version 7.1 is no longer supported as of October 31, 2020. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk® Enterprise. For documentation on the most recent version, go to the latest release.
Acrobat logo Download topic as PDF

makeresults

Description

Generates the specified number of search results in temporary memory.

If you do not specify any of the optional arguments, this command runs on the local machine and generates one result with only the _time field.

Syntax

The required syntax is in bold.

| makeresults
[<count>]
[<annotate>]
[<splunk-server>]
[<splunk-server-group>...]

Required arguments

None.

Optional arguments

<count>
Syntax: count=<num>
Description: The number of results to generate. If you do not specify the annotate argument, the results have only the _time field.
Default: 1
<annotate>
Syntax: annotate=<bool>
Description: If annotate=true, generates results with the fields shown in the table below.
If annotate=false, generates results with only the _time field.
Default: false
Fields generated with annotate=true
Field Value
_raw None.
_time Date and time that you run the makeresults command.
host None.
source None.
sourcetype None.
splunk_server The name of the server that the makeresults command is run on.
splunk_server_group None.
You can use these fields to compute aggregate statistics.
<splunk-server>
Syntax: splunk_server=<string>
Description: Use to generate results on one specific server. Use 'local' to refer to the search head.
Default: local. See the Usage section.
<splunk-server-group>
Syntax: (splunk_server_group=<string>)...
Description: Use to generate results on a specific server group or groups. You can specify more than one <splunk_server_group>.
Default: none. See the Usage section.

Usage

The makeresults command is a report-generating command. See Command types.

Generating commands use a leading pipe character and should be the first command in a search.

The search results created by the makeresults command are created in temporary memory and are not saved to disk or indexed.

You can use this command with the eval command to generate an empty result for the eval command to operate on. See the Examples section.

Order-sensitive processors might fail if the internal _time field is absent.

Specifying server and server groups

If you use Splunk Cloud Platform, omit any server or server group argument.

If you are using Splunk Enterprise, by default results are generated only on the originating search head, which is equivalent to specifying splunk_server=local. If you provide a specific splunk_server or splunk_server_group, then the number of results you specify with the count argument are generated on the all servers or server groups that you specify.

If you specify a server, the results are generated for that server, regardless of the server group that the server is associated with.

If you specify a count of 5 and you target 3 servers, then you will generate 15 total results. If annotate=true, the names for each server appear in the splunk_server column. This column will show that each server produced 5 results.

Basic examples

1. Create a result as an input into the eval command

Sometimes you want to use the eval command as the first command in a search. However, the eval command expects events as inputs. You can create a dummy event at the beginning of a search by using the makeresults command. You can then use the eval command in your search.

| makeresults | eval newfield="some value"

The results look something like this:

_time newfield
2020-01-09 14:35:58 some value

2. Determine if the modified time of an event is greater than the relative time

For events that contain the field scheduled_time in UNIX time, determine if the scheduled time is greater than the relative time. The relative time is 1 minute before now. This search uses a subsearch that starts with the makeresults command.

index=_internal sourcetype=scheduler ( scheduled_time > [ makeresults | eval it=relative_time(now(), "-m") | return $it ] )

Extended examples

1. Create daily results for testing

You can use the makeresults command to create a series of results to test your search syntax. For example, the following search creates a set of five results:

| makeresults count=5

The results look something like this:

_time
2020-01-09 14:35:58
2020-01-09 14:35:58
2020-01-09 14:35:58
2020-01-09 14:35:58
2020-01-09 14:35:58

Each result has the same timestamp which, by itself, is not very useful. But with a few additions, you can create a set of unique dates. Start by adding the streamstats command to count your results:

| makeresults count=5 | streamstats count

The results look something like this:

_time count
2020-01-09 14:35:58 1
2020-01-09 14:35:58 2
2020-01-09 14:35:58 3
2020-01-09 14:35:58 4
2020-01-09 14:35:58 5

You can now use that count to create different dates in the _time field, using the eval command.

| makeresults count=5 | streamstats count | eval _time=_time-(count*86400)

The calculation multiplies the value in the count field by the number of seconds in a day. The result is subtracted from the original _time field to get new dates equivalent to 24 hours ago, 48 hours ago, and so forth. The seconds in the date are different because _time is calculated the moment you run the search.

The results look something like this:

_time count
2020-01-08 14:45:24 1
2020-01-07 14:45:24 2
2020-01-06 14:45:24 3
2020-01-05 14:45:24 4
2020-01-04 14:45:24 5

The dates start from the day before the original date, 2020-01-09, and go back five days.

Need more than five results? Simply change the count value in the makeresults command.

2. Create hourly results for testing

You can create a series of hours instead of a series of days for testing. Use 3600, the number of seconds in an hour, instead of 86400 in the eval command.

| makeresults count=5 | streamstats count | eval _time=_time-(count*3600)

The results look something like this:

_time count
2020-01-09 15:35:14 1
2020-01-09 14:35:14 2
2020-01-09 13:35:14 3
2020-01-09 12:35:14 4
2020-01-09 11:35:14 5

Notice that the hours in the timestamp are 1 hour apart.

3. Add a field with string values

You can specify a list of values for a field. But to have the values appear in separate results, you need to make the list a multivalue field and then expand that multivalued list into separate results. Use this search, substituting your strings for buttercup and her friends:

| makeresults | eval test="buttercup rarity tenderhoof dash mcintosh fleetfoot mistmane" | makemv delim=" " test | mvexpand test

The results look something like this:

_time test
2020-01-09 16:35:14 buttercup
2020-01-09 16:35:14 rarity
2020-01-09 16:35:14 tenderhoof
2020-01-09 16:35:14 dash
2020-01-09 16:35:14 mcintosh
2020-01-09 16:35:14 fleetfoot
2020-01-09 16:35:14 mistmane

4. Create a set of events with multiple fields

Let's start by creating a set of four events. One of the events contains a null value in the age field.

| makeresults count=4 | streamstats count | eval age = case(count=1, 25, count=2, 39, count=3, 31, count=4, null()) | eval city = case(count=1 OR count=3, "San Francisco", count=2 OR count=4, "Seattle")

  • The streamstats command is used to create the count field. The streamstats command calculates a cumulative count for each event, at the time the event is processed.
  • The eval command is used to create two new fields, age and city. The eval command uses the value in the count field.
  • The case function takes pairs of arguments, such as count=1, 25. The first argument is a Boolean expression. When that expression is TRUE, the corresponding second argument is returned.

The results of the search look like this:

_time age city count
2020-02-05 18:32:07 25 San Francisco 1
2020-02-05 18:32:07 39 Seattle 2
2020-02-05 18:32:07 31 San Francisco 3
2020-02-05 18:32:07 Seattle 4

In this example, the eventstats command generates the average age for each city. The generated averages are placed into a new field called avg(age).

The following search is the same as the previous search, with the eventstats command added at the end:

| makeresults count=4 | streamstats count | eval age = case(count=1, 25, count=2, 39, count=3, 31, count=4, null()) | eval city = case(count=1 OR count=3, "San Francisco", count=2 OR count=4, "Seattle") | eventstats avg(age) BY city

  • For San Francisco, the average age is 28 = (25 + 31) / 2.
  • For Seattle, there is only one event with a value. The average is 39 = 39 / 1. The eventstats command places that average in every event for Seattle, including events that did not contain a value for age.

The results of the search look like this:

_time age avg(age) city count
2020-02-05 18:32:07 25 28 San Francisco 1
2020-02-05 18:32:07 39 39 Seattle 2
2020-02-05 18:32:07 31 28 San Francisco 3
2020-02-05 18:32:07 39 Seattle 4

5. Add a field with a set of random numbers

If you need to test something with a set of numbers, you have two options:

  • You can add a field with a set of numbers that you specify. This is similar to adding a field with a set of string values, which is shown in the previous example.
  • You can add a field with a set of randomly generated numbers by using the random function, as shown below:

| makeresults count=5 | streamstats count | eval test=random()/random()

The results look something like this:

_time count test
2020-01-08 14:45:24 1 5.371091109260495
2020-01-07 14:45:24 2 0.4563314783228324
2020-01-06 14:45:24 3 0.804991002129475
2020-01-05 14:45:24 4 1.4946919835236068
2020-01-04 14:45:24 5 24.193952675772845

Use the round function to round the numbers up. For example, this search rounds the numbers up to four digits to the right of the decimal:

...| eval test=round(random()/random(),4)

The results look something like this:

_time count test
2020-01-08 14:45:24 1 5.3711
2020-01-07 14:45:24 2 0.4563
2020-01-06 14:45:24 3 0.8050
2020-01-05 14:45:24 4 1.4947
2020-01-04 14:45:24 5 24.1940

See also

Commands
gentimes
Last modified on 10 September, 2021
PREVIOUS
makemv
  NEXT
map

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.0.10, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.1.5, 8.1.6, 8.1.7, 8.1.8, 8.1.9, 8.1.10, 8.1.11, 8.1.12, 8.1.13, 8.1.14, 8.2.0, 8.2.1, 8.2.2, 8.2.3, 8.2.4, 8.2.5, 8.2.6, 8.2.7, 8.2.8, 8.2.9, 8.2.10, 8.2.11, 8.2.12


Was this documentation topic helpful?


You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters