topic How to pass static string via lookup to stats command? in Splunk Search

How to pass static string via lookup to stats command?

dfphere — Tue, 18 Oct 2022 18:31:27 GMT

I'm attempting to utilize a lookup to pass static strings to create 'stats' commands. The result is sent to the search but it's treated as a large string instead of the various values/statistical operations that are part of the search. I'm wondering if there's a way to get Splunk to interpret the command as intended.

Re: Pass static string via lookup to stats command

bowesmana — Mon, 17 Oct 2022 22:49:57 GMT

Unfortunately it can't (yet) be done - I created a Splunk idea a couple of years ago for this

https://ideas.splunk.com/ideas/EID-I-398

but it's not been adopted - although marked as 'future prospect'.

Re: Pass static string via lookup to stats command

dfphere — Mon, 17 Oct 2022 23:06:03 GMT

Bummer, but I upvoted to help the cause. Any chance you found a work around?

Re: Pass static string via lookup to stats command

bowesmana — Mon, 17 Oct 2022 23:11:23 GMT

Sadly no workaround - the idea of using externally defined control strings to influence SPL just isn't practically possible other than in the way represented in the idea.

I guess the 'workaround' is to try to understand your use case to see why you are trying to do that anyway and whether you really need it.

You can do some generic stuff with macros, but even then, not really dynamically, as macros are expanded _before_ the search is executed, so cannot take account of field values in the pipeline

😞