topic Re: Use eval field inside append search in Splunk Enterprise

Use eval field inside append search

mad_splunker — Mon, 25 Sep 2023 07:37:03 GMT

Hello Splunkers,

I am trying below query -

index=someindex cluster=gw uuid=gw98037234c6e51a48816016172b8a3c56 | eval api_uuid="gw"+reqid | head 1 | append [search index=someindex cluster=api uuid=api_uuid]

Basically what I am trying is to get result from first search, evaluate new field from first search and add it as condition to second search. It is not working if I supply api_uuid field but If I replace uuid in append with actual computed value it is returning proper result. I have seen few people using join but dont want to use join as its expensive and comes with limit. Any solution to above query ?

Re: Use eval field inside append search

kamlesh_vaghela — Mon, 25 Sep 2023 07:41:38 GMT

@mad_splunker

index=someindex cluster=api uuid=api_uuid [ search index=someindex cluster=gw uuid=gw98037234c6e51a48816016172b8a3c56 | eval uuid="gw"+reqid | table uuid ]

Can you please try this? I have used different approach.

thanks

Re: Use eval field inside append search

mad_splunker — Mon, 25 Sep 2023 08:24:09 GMT

Nope not working