topic Re: Assign a string to a Variable in Search Bar in Splunk Search

Assign a string to a Variable in Search Bar

vkakani60 — Mon, 13 Jun 2016 14:08:27 GMT

I would like to assign a string to a variable, like valid ="error" then use the variable with the stats or timechart parameters, I have used eval command which is not working, really not sure which inbuilt variable command will help.

  index="SubProduct" sourcetype="access_log" "Error due to validation" | timechart count by host

Is it possible to assign the string to a variable like this

  index="SubProduct" sourcetype="access_log" Valid = "Error due to validation" | timechart count(Valid) by host

I have used
eval valid ="Error due to validation" command which is not working in this case.

Re: Assign a string to a Variable in Search Bar

Raghav2384 — Mon, 13 Jun 2016 15:19:34 GMT

Ok, if i understand you correct, you would like to dynamically extract Error messages from logs and assign it to a field? If yes, that is very much possible using eval

You could you regular expressions to extract the Error string and assign it to field
Syntax: ....|rex field=_raw "...(?P"Error...blah blah")" Refer: http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Rex

Using evals to look for Error and assign a generic value to the new Field. Example

Syntax: ....|eval Valid=if(match(_raw,"Error"),"Error","") etc (Endless possibilities here)

Hope this leads you where you want to be 🙂

Thanks,
Raghav

Re: Assign a string to a Variable in Search Bar

sshelly_splunk — Mon, 13 Jun 2016 15:25:31 GMT

Does this help?
index="SubProduct" sourcetype="access_log" "Error due to validation" | rex (?"Error due to validation") | timechart count(Valid) by host

Re: Assign a string to a Variable in Search Bar

vkakani60 — Mon, 13 Jun 2016 19:44:33 GMT

How you brought up the count(Valid) command without creating a Valid variable ? I want to achieve something like, assign a string to the variable called 'Value' then have to count the 'Value', technically I am counting the similar repeated string.

Re: Assign a string to a Variable in Search Bar

vkakani60 — Mon, 13 Jun 2016 20:35:10 GMT

I downvoted this post because misleading answer without structure.

Re: Assign a string to a Variable in Search Bar

sshelly_splunk — Mon, 13 Jun 2016 20:59:59 GMT

for some reason, I cannot put in the exact search string ... use your search and pipe it to rex as described here:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rex
Look at example 1. You are looking to create a single field, so use the first part of example 1. i got it to work, but for some reason, when I post my exact search string, it gets mashed up upon post.