eval,passing a value in eval

jaygamini — Fri, 09 Feb 2018 06:02:37 GMT

Hi all,

Please help me … not been success in passing the output of the search into a new search (different table).

index=voipdata 01448ACD5A7CCC212AFD039D
|stats values(MSISDN) as MSISDN|rex field=MSISDN "(?\d+)"|eval V5CallRoute1=if(tdr="V5CallRoute" AND PAITEL="{tel:+%phone%}",CallDataKey,NULL)
|table V5CallRoute1

Line by line explanation ...
index=voipdata 01448ACD5A7CCC212AFD039D |stats values(MSISDN) as MSISDN
// This returns a phone number {18433231540}
rex field=MSISDN "(?\d+)"
//This will format the above output to remove the bracket, hence 18433231540
eval V5CallRoute1=if(tdr="V5CallRoute" AND PAITEL="{tel:+%phone%}",CallDataKey,NULL)
//This is where I need help. Essentially , I’m searching the phone number on “V5CallRoute” table now. Here is an example of the field “PAITEL” -> PAITEL={tel:+18433231540} . So I ‘m trying to pass variable “phone” , apparently not getting any output.

Thanks

Re: eval,passing a value in eval

harsmarvania57 — Fri, 09 Feb 2018 12:59:03 GMT

Hi,

As you are doing |stats values(MSISDN) as MSISDN, fields (tdr , CallDataKey , PAITEL) which require in eval is dropped by stats command

so I have created run anywhere search with some sample data and it is producing desired output

| makeresults | eval MSISDN="{18433231540}", tdr="V5CallRoute", PAITEL="{tel:18433231540}", CallDataKey="test123"
| stats values(MSISDN) as MSISDN, values(tdr) AS tdr, values(CallDataKey) AS CallDataKey, values(PAITEL) AS PAITEL
| rex field=MSISDN "(?<phone>\d+)"
| eval V5CallRoute1=if(tdr="V5CallRoute" AND PAITEL="{tel:"+phone+"}",CallDataKey,NULL)
| table V5CallRoute1

So in your case your query will be

index=voipdata 01448ACD5A7CCC212AFD039D
| stats values(MSISDN) as MSISDN, values(tdr) AS tdr, values(CallDataKey) AS CallDataKey, values(PAITEL) AS PAITEL
| rex field=MSISDN "(?<phone>\d+)"
| eval V5CallRoute1=if(tdr="V5CallRoute" AND PAITEL="{tel:"+phone+"}",CallDataKey,NULL)
| table V5CallRoute1

I hope this helps.

topic Re: eval,passing a value in eval in Splunk Search

eval,passing a value in eval

Re: eval,passing a value in eval