topic Re: is there a way to pass field value from search to write kind of an event in the same search using eval command ? in Splunk Search

Is there a way to pass field value from search to write kind of an event in the same search using eval command?

ak9092 — Fri, 20 May 2022 15:21:08 GMT

Hey Splunkers,

I am not sure if this is possible or not but what i was trying to do is something like passing the values of search in the eval command to basically form a statement or an event .

So for example consider below search returns multiple users first name, last name and country details.

Now with that field values what i am trying to do is create a eval statement like below-

index=foo source=user_detail

|table first_name last_name country

|eval statement = My name is "$first_name $ $last_name$ and i come from $country$

|table statement

But this is not passing those field values to eval statement, so anyone knows if there is a way we can do this ?

Thanks.

Re: is there a way to pass field value from search to write kind of an event in the same search using eval command ?

gcusello — Fri, 20 May 2022 15:04:59 GMT

Hi @ak9092,

let me understand: you want to concatenatethree fields value in only one, is it correct?

if this is your need, please try this:

index=foo source=user_detail | eval statement="My name is ".first_name." ".last_name." and i come from ".country | table statement

Ciao.

Giuseppe

Re: is there a way to pass field value from search to write kind of an event in the same search using eval command ?

ak9092 — Fri, 20 May 2022 15:17:35 GMT

That's exactly what I needed, Thanks much @gcusello

Re: is there a way to pass field value from search to write kind of an event in the same search using eval command ?

gcusello — Fri, 20 May 2022 15:26:23 GMT

Hi @ak9092,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉