https://community.splunk.com/t5/Splunk-Search/How-to-use-tokens-in-same-search-query/m-p/409247#M118068 <P>Hi knalla,<BR /> let me understand: $result.user$ token arrives from a dropdown input?<BR /> what's "modifyincidents"? it isn't a command.<BR /> Anyway, if you want to assign a token's value to a field, you can use the eval command:</P> <PRE><CODE>index=alerts status=resolved | dedup incident_id |table incident_id user | lookup incidents incident_id OUTPUTNEW alert, title, owner, status, impact, urgency, external_reference_id | search owner=unassigned | eval owner="$result.user$" </CODE></PRE> <P>The table command in the middle of a search it isn't useful, if you want to limit the fields that your search uses, use the fields command.</P> <P>Bye.<BR /> Giuseppe</P> Mon, 29 Jul 2019 15:07:35 GMT gcusello 2019-07-29T15:07:35Z https://community.splunk.com/t5/Splunk-Search/How-to-use-tokens-in-same-search-query/m-p/409246#M118067 <P>Hello, </P> <P>I'm trying to pass values of field to other field. Is there a best way to do it?</P> <P>Query:</P> <P>index=alerts status=resolved | dedup incident_id|table incident_id user <BR /> | lookup incidents incident_id OUTPUTNEW alert, title, owner, status, impact, urgency, external_reference_id|search owner=unassigned |modifyincidents owner="$result.user$"</P> <P>I'm trying to pass user value to owner.</P> Wed, 30 Sep 2020 01:28:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-tokens-in-same-search-query/m-p/409246#M118067 knalla 2020-09-30T01:28:22Z https://community.splunk.com/t5/Splunk-Search/How-to-use-tokens-in-same-search-query/m-p/409247#M118068 <P>Hi knalla,<BR /> let me understand: $result.user$ token arrives from a dropdown input?<BR /> what's "modifyincidents"? it isn't a command.<BR /> Anyway, if you want to assign a token's value to a field, you can use the eval command:</P> <PRE><CODE>index=alerts status=resolved | dedup incident_id |table incident_id user | lookup incidents incident_id OUTPUTNEW alert, title, owner, status, impact, urgency, external_reference_id | search owner=unassigned | eval owner="$result.user$" </CODE></PRE> <P>The table command in the middle of a search it isn't useful, if you want to limit the fields that your search uses, use the fields command.</P> <P>Bye.<BR /> Giuseppe</P> Mon, 29 Jul 2019 15:07:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-tokens-in-same-search-query/m-p/409247#M118068 gcusello 2019-07-29T15:07:35Z