topic Re: Storing a string in a variable in Splunk Search

How to store this string in a variable and use it in any other index?

nikhilmalkari18 — Tue, 21 Jun 2022 18:46:42 GMT

index = "abc" required_field = "xx" | table date - gives me a single string in the table. How can I store this string in a variable and use it in any other index.

Thank you

Re: Storing a string in a variable

VatsalJagani — Mon, 20 Jun 2022 18:26:15 GMT

@nikhilmalkari18

IF you want to add a new field into data/events found in index=abc, then

index=abc | eval required_field = "xx"

If there are no events already, and for testing, if you want to generate a new event, then

| makeresults | eval required_field = "xx"

I hope this helps!!!

Re: Storing a string in a variable

nikhilmalkari18 — Mon, 20 Jun 2022 18:29:36 GMT

I do not want to add a new field to the index. I want to know how to store a string coming from a search command in a variable.

Re: Storing a string in a variable

PickleRick — Mon, 20 Jun 2022 18:31:25 GMT

What do you mean by "using it in another index"?

SPL is not a procedural language and in general doesn't have the concept of "variables" as external storage to hold state between different searches.

There are some techniques which can be used to store something resembling a state - KV-store, collecting to summary index. But this is pretty advanced stuff (from the conceptual point of view - technically it's relatively easy) and I very much doubt that's what you need.

If you want to search for values from another search, you might use subsearch but also often can rephrase your problem to do the search in a completely different way.

Re: Storing a string in a variable

VatsalJagani — Mon, 20 Jun 2022 19:10:07 GMT

@nikhilmalkari18 - That's what eval command does. But this does not store variables/fields permanently. Its scope is limited to that particular search only.

If you want to do it for all searches implicitly, then you can use EVAL in the props.conf file. -> Calculated Fields - https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields

If you want to do it permanently you can do it by extracting the field at index time - https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/Configureindex-timefieldextraction

I hope this helps!!!