topic Re: Search using variables in Splunk Search

Search using variables

lakromani — Tue, 31 Jan 2017 20:30:44 GMT

This should be trivial to do, but I am not able to search using variables.

Eks this works
some splunk data | search direction="out"

But this does not:
some splunk data | eval test="out" | search direction="$test$"
nor this:
some splunk data | eval test="out" | search direction=$test$

What do I do wrong. Search google, but did not find and working solution.

Re: Search using variables

somesoni2 — Tue, 31 Jan 2017 20:41:43 GMT

What is the requirement here? From where this variable should come from? If it's a field from same search, you can use like this

some splunk data | eval test="out" | where direction=test

Re: Search using variables

lakromani — Tue, 31 Jan 2017 21:31:20 GMT

That did do it. Data is coming from a drop down input on a dashboard.
If you post it as an answer I can accept it 🙂