addinfo command: Overview, syntax, and usage

The SPL2 addinfo command adds fields to each event. These fields contain global, common information about the search.

The SPL2 addinfo command adds fields to each event. These fields contain global, common information about the search. This command is primarily an internally-used component of Summary Indexing. See Use summary indexing for increased search efficiency

Syntax

The required syntax is in bold.

addinfo

Usage

This command expects events. You can't use this command after an SPL2 command that returns summary information, such as the stats command.

The following fields are added to each event when you use the addinfo command:

  • info_min_time. The earliest time boundary for the search, in UNIX time.
  • info_max_time. The latest time boundary for the search, in UNIX time.
  • info_search_time The time when the search was run, in UNIX time.
  • info_sid. The ID of the search that generated the event.

See also

addinfo command

addinfo command: Examples