topic Re: Possible to set token values without displaying them? in Splunk Search

Possible to set token values without displaying them?

shrutigupta — Sun, 04 Jun 2017 20:20:08 GMT

So, basically I've a query which ends something like this:

| eval uf = if(like(one_reason, "%unknown_failure%"), uf.thread_id, uf) 
| stats count by one_reason | sort -count

So I'm displaying a field called one_reason which can take a value called unknown_failure in which case I want the value of variable uf.
However I can't set token to $uf$
I've been accessing one_reason as $row.one_reason$
Any way to access uf without displaying it?
Thanks!

Re: Possible to set token values without displaying them?

woodcock — Mon, 05 Jun 2017 05:16:21 GMT

Believe it or not, YES! It is a little-known fact about Splunk that any field that starts with an underscore character ( _ ) will not be displayed on the Statustics tab but it is still accessible (with the exception of _time which is a very, VERY special field). You can (not) see the invisibility like this:

index=_* 
| stats count BY sourcetype
| sort 0 - count
| streamstats count AS _serial

And then add this to prove that it really is there:

| eval serial=_serial

So do this:

| eval uf = if(like(one_reason, "%unknown_failure%"), uf.thread_id, uf) 
| stats count values(uf) AS _uf BY one_reason | sort 0 - count

Or similar and then reference $_uf$

Re: Possible to set token values without displaying them?

jkat54 — Mon, 05 Jun 2017 12:34:40 GMT

http://docs.splunk.com/Documentation/Splunk/latest/Viz/tokens

This article has all the details you need.

You can create a dynamic drop down that populated the token but even if the user opens the the panel in search, they won't know what search created the token. They will only see the value that was set. That combined with using the _ method woodcock mentioned, should solve your problem.