topic Re: Read a field value which field name is in another field. in Splunk Search

How to read a field value which field name is in another field?

mseijos — Thu, 30 Jun 2022 22:32:25 GMT

We have this table:

And we want to have a field (for example, named "value") that gets the value of the field which name is in the "name" field.
In the first row it would be value=3d, in the second row value would be value=1

Its similar to what
| eval {name} = "whatever"

would do, but reading instead of writing.
(something like | eval value = {name} but that doesn't work).

Re: Read a field value which field name is in another field.

woodcock — Fri, 29 Nov 2019 03:27:09 GMT

Like this:

... | foreach name [ eval value="<<FIELD>>" ]

Re: Read a field value which field name is in another field.

mseijos — Fri, 29 Nov 2019 08:09:26 GMT

I tried your solution with this code:

| makeresults
| eval a="1"
| eval b="2"
| eval name="a"
| foreach name [ eval value="<<FIELD>>" ]

But "value" field gets the literal "name" as value. If I remove the quotes in <<FIELD>>, I get the literal "a" in "value" field.
The expected "value" field would be "1"

Re: Read a field value which field name is in another field.

kulick — Tue, 29 Sep 2020 20:01:57 GMT

I needed something like this also.

How about this inefficient solution? It seems to work as long as you get the right fields into the `foreach` part...

| makeresults count=10 | streamstats count | eval a="1", b="2", name="count" | foreach * [ eval value=mvindex(mvappend(case(name="<<FIELD>>",'<<FIELD>>'),value),0) ]

Re: Read a field value which field name is in another field.

ITWhisperer — Wed, 30 Sep 2020 06:56:21 GMT

Re: Read a field value which field name is in another field.

HappySplunker — Wed, 22 Dec 2021 14:54:06 GMT

Hi @mseijos, I stumbled accross the same problem and think I got a solution, based on previous contribs:

I added dummy values to test the code, as simpler solutions weren't working with a lot of fields per log (because foreach parses all values)

I know it's surely too late for you, but maybe some others will find this interesting.

Re: Read a field value which field name is in another field.

pm771 — Thu, 30 Jun 2022 21:28:23 GMT

@HappySplunker

Your solution simplifies OP's requirements. You made an assumption that

name="count"

for every event.

This is not the case.

Re: Read a field value which field name is in another field.

HappySplunker — Fri, 23 Sep 2022 08:11:07 GMT

Here's an updated version to be as close as possible to OP's requirements:

| makeresults count=4 | streamstats count | eval age = case(count=1, 12, count=2, 25, count=3, 65, count=4, 21) | eval city = case(count=1, "Paris", count=2, "Berlin",count=3, "Tokyo", count=4, "Madrid") | eval name = case(count=1, "age", count=2, null(),count=3, "city", count=4, null()) | fields - _time count | foreach * [| eval fieldnames=mvappend(fieldnames,"<<FIELD>>") | eval fieldvalues=mvappend(fieldvalues,<<FIELD>>) | eval value=mvindex(fieldvalues,mvfind(fieldnames,name)) ] | fields - fieldnames fieldvalues

Re: Read a field value which field name is in another field.

VatsalJagani — Tue, 17 Oct 2023 07:12:45 GMT

@mseijos - Marking this answer as accepted as it seems working. And it has been answered correctly first. Let me know if this doesn't work for you.

Splunk Community Moderator,

Vatsal Jagani