topic Re: How can i assign a value to a variable in a splunk in Getting Data In

How can i assign a value to a variable in a splunk

Med_Ryad — Wed, 10 Jul 2024 08:07:29 GMT

Hello everyone,

I am looking for a way to assign values to variables in order to avoid repetition in my query. I want to search in different resources using the same variables in the same query. I have tried the following, but it does not seem to work:

| makeresults | eval var_1="var_1_content" | eval var_2="var_2_content" | search (sourcetype=var_1 OR sourcetype=var_2)

Could you please help me correct this or provide an alternative approach to achieve this? Thank you for your assistance!

Re: How can i assign a value to a variable in a splunk

ITWhisperer — Wed, 10 Jul 2024 07:57:36 GMT

It is a bit unclear what it is you are trying to do but perhaps this approach might help you

index=main [! makeresults | eval sourcetype=split("var_1_content,var_2_content",",") | mvexpand sourcetype | table sourcetype]

Re: How can i assign a value to a variable in a splunk

Med_Ryad — Wed, 10 Jul 2024 08:18:48 GMT

hi @ITWhisperer , thanks for your answer ,

I have the following query:

(sourcetype="mysource1" OR sourcetype="mysource2") AND (Node__name="myserver_name" OR (object__Name="myserver_name*") OR (location__Name="*myserver_name*"))

What I am trying to achieve is to assign the value "myserver_name" to a variable (e.g., servername) in order to avoid repetition. This way, if I need to modify the query, I only have to update the declared variable. I am looking for something like this:

| eval servername = "myserver_name"
(sourcetype="mysource1" OR sourcetype="mysource2") AND (Node__name=servername OR (object__Name=servername) OR (location__Name=servername))

This would allow me to use the variable servername instead of repeating the value "myserver_name" multiple times in the query.

i hope that it's clear now !

Re: How can i assign a value to a variable in a splunk

ITWhisperer — Wed, 10 Jul 2024 08:40:37 GMT

Try something like this

Re: How can i assign a value to a variable in a splunk

Med_Ryad — Wed, 10 Jul 2024 09:23:56 GMT

Perfect ! thank you so much !