topic Re: foreach on REST endpoint data in Splunk Enterprise

Help with foreach on REST endpoint data

andrew_nelson — Fri, 30 Sep 2022 14:33:17 GMT

I'm trying to get a list of fields by sourcetype without going down the route of fieldsummary and thought analyzing the props configs would be a good place to start.

I'm starting with EVAL generated fields but not having any luck on the foreach section.
Any pointers would be much appreciated.

| rest splunk_server=local /servicesNS/-/-/configs/conf-props | table title EVAL-a* | eval eval_fields="" | foreach EVAL-* [ eval eval_fields=if(isnotnull(<<FIELD>>), mvappend(eval_fields,'<<MATCHSTR>>'), eval_fields) ] | table title eval_fields *

Re: foreach on REST endpoint data

kamlesh_vaghela — Fri, 30 Sep 2022 13:25:33 GMT

@andrew_nelson

Can you please try this in foreach?

[ eval eval_fields= if(isnotnull('<<FIELD>>'), mvappend(eval_fields,"<<MATCHSTR>>"), eval_fields) ]

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: foreach on REST endpoint data

andrew_nelson — Fri, 30 Sep 2022 13:29:57 GMT

You're a legend KV ! Thanks a million.
Been annoying me all day trying to figure out this.

Re: foreach on REST endpoint data

kamlesh_vaghela — Fri, 30 Sep 2022 13:31:29 GMT

😊😍

Re: foreach on REST endpoint data

richgalloway — Fri, 30 Sep 2022 13:39:54 GMT

You're very close. The <<FIELD>> specifier should be enclosed in single quotes so Splunk treats "EVAL-action" as a field name instead of an expression. Also, <<MATCHSTR>> should be in double quotes so the string "action" rather than the non-existent field 'action' is appended to eval_fields.

| rest splunk_server=local /servicesNS/-/-/configs/conf-props | fields title EVAL-a* | eval eval_fields="" | foreach EVAL-* [ eval eval_fields=if(isnotnull('<<FIELD>>'), mvappend(eval_fields,"<<MATCHSTR>>"), eval_fields) ] | table title eval_fields *

Re: foreach on REST endpoint data

andrew_nelson — Fri, 30 Sep 2022 14:01:16 GMT

Thanks Rich. I was thinking along the lines of putting anything in double quotes would be interpreted literally so <<MATCHSTR>> would have ended up in my multivalue field.
Thanks for the detailed explanation.

Re: foreach on REST endpoint data

richgalloway — Fri, 30 Sep 2022 14:12:43 GMT

Understood. Like $tokens$ in dashboards and the map command, <<tokens>> in foreach are always expanded, even when quoted.