topic Field data from fieldname in variable in Splunk Search

Field data from fieldname in variable

auradk — Tue, 17 Apr 2018 17:03:28 GMT

Any way of achieving this:

| makeresults 
| eval Column1="MyData"
| eval TestField="Column1"
| eval Result{TestField}=if('{TestField}'="MyData",1,0)

The reason is simple. I want to define a lookup with all the fieldnames (columns) that is required for a specific category of events.
My current search is larger than this, but i have found this example to describe my problem the best. if i solve this i can solve the rest. The result should be that ResultColumn1 = 1

{TestField} works on the left side of = but not on the right side in the eval.
I tried every combination of TestField including (',",$,$$,<<) but i am not able to retrieve the data from the field which is defined in TestField.
If i use {TestField} on the right side of = i get an error. This is why i have put '{TestField}' in my example above.

I am using Enterprise 7.0.1

Any help is appreciated.

Re: Field data from fieldname in variable

somesoni2 — Tue, 17 Apr 2018 17:48:08 GMT

Give this a try

| makeresults 
 | eval Column1="MyData"
 | eval TestField="Column1"
 | eval Result{TestField}=""
 | foreach Result* [| eval "<<FIELD>>"=if('<<MATCHSTR>>'="MyData",1,0)]

Re: Field data from fieldname in variable

auradk — Tue, 17 Apr 2018 21:56:33 GMT

Thank you so much - i battled with that all day 🙂
It worked like a charm and even made my other query more simpel.
I see now that i simply did not understand the documentation of foreach. Now i do.