topic Re: How to use an evaluated field in search command? in Splunk Search

How to use an evaluated field in search command?

biju_babu — Mon, 06 Jun 2022 03:51:49 GMT

Could you please let me know how to use an evaluated field in search command

index=main sourcetype="access_combined"

| eval field1="search-val1|search-val2"

| eval searchval=mvindex(split(field1,"|"),1)

| search "*search-val2*"

I am trying to create a dashboard with one of the search as above. I get the field1 value from dropdown list in dashboard. Something like

| eval field1 = $searchkey$

The above works with the static value in search command but I am trying to use searchval field in search command like

| search 'searchval'

Can someone help? Thanks for the help.

Re: Search with evaluated field

ITWhisperer — Sun, 05 Jun 2022 19:24:19 GMT

Try something like this

| search [| makeresults | fields - _time | eval field1 = $searchval$]

Re: Search with evaluated field

biju_babu — Sun, 05 Jun 2022 20:14:46 GMT

sorry - that is not working.

Basically, I need to execute command like this

index=main sourcetype="access_combined" "*search-val2*"

where "search-val2" get evaluate from pipe(|) separated string

Re: How to use an evaluated field in search command?

yuanliu — Mon, 06 Jun 2022 05:52:42 GMT

Is there any reason why "search" is the only choice command? Why not use where? For example,

| where match(_raw, searchval)

Re: Search with evaluated field

ITWhisperer — Mon, 06 Jun 2022 06:40:16 GMT

Do the separation in the makeresults subsearch

Re: How to use an evaluated field in search command?

biju_babu — Mon, 06 Jun 2022 20:05:34 GMT

what if i use "where" command to set the source. does it impact the performance?

Example using #2 instead of #1

1. index=main sourcetype="access_combined" source="app1"

2. index=main sourcetype="access_combined" | where match(source,"app1")

Re: How to use an evaluated field in search command?

yuanliu — Tue, 07 Jun 2022 04:47:50 GMT

This will affect performance mainly because the first search in #2 will return more events than that in #1.

As a side, if source is precisely "app1", do not use match(). Just say | where source=="app1". A callout to a function adds to memory and compute; and match() is a regex function, adds even more compute.