Addinfo Command in Splunk

addinfo command in splunk
addinfo command in splunk

The addinfo command in splunk is used to enhance the information about a particular event which is not shown in the _raw events, Hence in order to get more information we use addinfo command –

This command comes with its own functions which can be used with this command like –

  • Info_search_time – using this you will get an exact time of the search query when it is executed
  • Info_sid – using this command you will get the search id and so on..

Addinfo command adds fields to each event that contain common information about the search. This command is primarily an internally-used elements of Summary Indexing.



The addinfo command adds the following fields to each event:

info_min_timeThe earliest time of the search.
info_max_time The latest time of the search.
info_sidSearch ID that generated the event.
info_search_timeThe time when the search was run.

Before using addinfo command:

index=* | stats c by metric_unit

Results before using addinfo command:

addinfo command in splunk

After using addinfo command:

index=* | stats c by metric_unit | addinfo

Results after using addinfo command:

Addinfo Command in Splunk


Th addinfo command automatically adds the time factor in the _raw events containing all the values which are responsible for searching with a specific timerange it was searched for.

Also looking more more such commands in splunk: CLICK HERE

If you are still facing issue regarding this topic, Feel free to Ask Doubts in the Comment Box Below and Don’t Forget to Follow us on social platforms, Happy Splunking >

What do you think?

Leave a Reply

Your email address will not be published. Required fields are marked *

GIPHY App Key not set. Please check settings

appencols command in splunk

Appendcols Command in Splunk

bin command in splunk

Bin Command Splunk