Using the makeresults command
When learning a new command, you might need some pretend search results to work with. This can help you to create dashboards, prototypes, perform testing, or perform any other task that requires search results.
Solution
This video shows you how to effectively use the makeresults command to generate a specified number of search results in temporary memory. You'll learn:
- How to return a single result or more than one result
- How to use the
annotate
argument to generate values for the_raw
,_time
,host
,source
, andsourcetype
fields, as well as the Splunk server - How to use the
format
argument to return results in CSV or JSON format - How to create a
host
andlocation
field to use with subsequent commands - How to use supporting commands like
streamstats
andeval
that are often paired withmakeresults
for even further customization
Next steps
In addition, these resources might help you understand and implement this guidance:
- Splunk Docs: Makeresults