topic Re: foreach variable and search in Splunk Search

foreach variable and search

raychamber — Thu, 16 Jul 2020 18:37:31 GMT

I have variables that I am trying to use to get in a search with a foreach loop...

for example.. I have customers: a, b, c, d, e

---

|makeresults | eval customer=a,b,c,d,e |

foreach customer

search index=main customer

Re: foreach variable and search

isoutamo — Thu, 16 Jul 2020 20:00:37 GMT

How about this:

index=main [| makeresults | eval customer = "a, b, c, d" | eval customer = split(customer, ",") | format]

Re: foreach variable and search

richgalloway — Thu, 16 Jul 2020 20:14:47 GMT

What is your question? Are you saying that query doesn't work for you? If so, what results do you get and what results are you expecting?

Try this alternative query.

index=main [ |makeresults | eval customer=a,b,c,d,e | fields customer | format ]

Re: foreach variable and search

raychamber — Thu, 16 Jul 2020 20:45:02 GMT

I get an error in the "eval" command for "customer=a,b,c"

Re: foreach variable and search

raychamber — Thu, 16 Jul 2020 20:49:16 GMT

This is working, but it isn't running the search.

index=main [| makeresults
| eval customer = "OPT, ANT"
| eval customer = split(customer, ",")
| format]

but the search isn't running. I can search for OPT alone

index=main OPT

and get results, same for ANT, but this way.. i don't get anything back.

Re: foreach variable and search

isoutamo — Thu, 16 Jul 2020 20:49:51 GMT

You should try:

...
| eval customer = "a, b, c, d"
| eval customer = split(customer, ",")
...

Re: foreach variable and search

raychamber — Thu, 16 Jul 2020 20:57:24 GMT

Please forgive me.. I am green as green can be..

do you mean...

index=main
[| makeresults
| eval customer = "OPT, ANT"
| eval customer = split(customer, ",")
| search customer]

i tried replacing the "search customer" with just "format" neither worked.

Re: foreach variable and search

richgalloway — Fri, 17 Jul 2020 00:48:14 GMT

I used the same syntax as in the original question, assuming you knew how to make it work. My mistake.

Try this, which builds on the suggestions made by others.

Re: foreach variable and search

raychamber — Thu, 16 Jul 2020 21:06:21 GMT

this doesn't give results...

having the entry

|eval customer = "a", "b", "c"

gives an error

Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.

I assume it can't be formatted that way.

Re: foreach variable and search

richgalloway — Fri, 17 Jul 2020 00:48:39 GMT

Yup. I got carried away with my quotation marks. Try the updated query.

Re: foreach variable and search

raychamber — Fri, 17 Jul 2020 20:28:53 GMT

No luck. I still get no result found, but can run a search and find them individually.

Re: foreach variable and search

isoutamo — Fri, 17 Jul 2020 20:38:42 GMT

at least this was working with _internal

index=_internal [| makeresults | eval component = "Metrics, cached, module, startup" | eval component = trim(split(component,",")) | format]

Re: foreach variable and search

raychamber — Fri, 17 Jul 2020 21:19:09 GMT

Right.. but this breaks it for some reason..

index=_internal
[| makeresults
| eval component = "thru, cached, module, startup"
| eval component = trim(split(component,","))
| format]

Re: foreach variable and search

isoutamo — Fri, 17 Jul 2020 21:32:13 GMT

For me it's still working. Of course different amount of different events, but still it's working.

Just tested on Darwin with 8.0.5 version.