topic Re: declare a variable in search string in Splunk Search

declare a variable in search string

Splunk_U — Tue, 08 Jan 2013 21:49:23 GMT

I have a search string (given below). Now I want to declare a variable named Os_Type, which based on the source type, will provide me OS Type.

index=os source=Perfmon:LocalLogicalDisk
| where like(counter, "% Free Space")
| stats avg(Value) as "availDiskPct" by host
| eval availDiskPct=round(availDiskPct, 2)

Now I have tried with
eval Os_Type=if($source$==":","WINDOWS","unix")
but it is not giving me the correct result.

Please help me!!!

Re: declare a variable in search string

Ayn — Tue, 08 Jan 2013 22:30:06 GMT

You're correct in that you should be using eval, but your eval statement looks a bit off. As it is now, "Os_Type" would only get the value "WINDOWS" if the source field is EXACTLY ":". Did you mean that it should CONTAIN ":"? If so, you should do something like

... | eval Os_Type=if(match(source,":"),"WINDOWS","unix")

Re: declare a variable in search string

Splunk_U — Wed, 09 Jan 2013 13:54:06 GMT

I meant that : should be present in the source. I tried with what you have suggested...but it is giving me the wrong result.

Re: declare a variable in search string

Splunk_U — Wed, 09 Jan 2013 16:16:30 GMT

even if I am trying to search the below mentioned string:

index=os source=Perfmon:LocalMainMemory
| where like(counter,"% Committed Bytes In Use")
| stats avg(Value) as "avgMemPct", max(Value) as "peakMemPct" by host
| eval avgMemPct=round(avgMemPct,2)
| eval peakMemPct=round(peakMemPct,2)
| eval Os_Type=if(source=="Perfmon:LocalMainMemory","WINDOWS","Unix")

the result is coming as Unix ...is there any problem with the conditional operator..

Re: declare a variable in search string

Ayn — Wed, 09 Jan 2013 19:01:42 GMT

Ah, I see now - you're putting your eval after the stats command. The only field output from stats will be the fields that it produces - in your case avgMemPct, peakMemPct and host. So, when you're doing your eval statement at the end, the source field no longer exists. You need to put the eval before your stats command and then do something like splitting by host AND Os_Type in order to get it to show in your results.

Re: declare a variable in search string

Splunk_U — Wed, 09 Jan 2013 19:53:44 GMT

tried to find how can we use split by...but did not find luck...can you please tell me the syntax for the same?

Re: declare a variable in search string

Ayn — Wed, 09 Jan 2013 20:01:37 GMT

Something like

index=os source=Perfmon:LocalMainMemory | where like(counter,"% Committed Bytes In Use") | eval Os_Type=if(source=="Perfmon:LocalMainMemory","WINDOWS","Unix") | stats avg(Value) as "avgMemPct", max(Value) as "peakMemPct" by host,Os_Type | eval avgMemPct=round(avgMemPct,2) | eval peakMemPct=round(peakMemPct,2)

should do it.

Re: declare a variable in search string

Splunk_U — Wed, 09 Jan 2013 20:37:37 GMT

Thank you!!!

Re: declare a variable in search string

muthvin — Mon, 11 Jan 2016 07:57:59 GMT

After declaring the variable will you be able to use Os_Type in calculating other fieldvalues?