topic How to filter the results based on the evaluated field? in Splunk Search

How to filter the results based on the evaluated field?

amerineni — Wed, 02 Nov 2022 21:55:19 GMT

I'm trying the below query,

index=XXXXXXXXX | eval space="cf_space_name=production" | search "space" YYYYYYYYYYYY | stats count

===================================================================

I want to filter the results based on the evaluated field.

| search "space" XXXXXXXXXXXXX => is not returning correct values

| search "cf_space_name=production" XXXXXXXXXXXXX => but If I use the value like this its working.

how to fix this? Thanks for the help.

Re: How to filter the results based on the evaluated field?

richgalloway — Thu, 03 Nov 2022 00:12:36 GMT

The search command treats "space" with or without quotation marks as a literal string rather than a field name.

The eval command assigns a value to a field, creating the field if necessary. It does not define variables that can be used in arbitrary places.

To search for specific text in an event, put that text in a search command.

Re: How to filter the results based on the evaluated field?

yuanliu — Thu, 03 Nov 2022 05:22:37 GMT

Like @richgalloway mentioned, the value in 'space' is not substituted as part of command in | search. Can you explain why it is even necessary to use that syntax if | search "cf_space_name=production" YYYYYYYYYYY already works? Maybe you are thinking of a token in dashboard?

(As a side, | search "cf_space_name=production" YYYYYYYYYYY is semantically different from | search cf_space_name=production YYYYYYYYYYY. You want to consider what exactly is intended.)

Re: How to filter the results based on the evaluated field?

amerineni — Thu, 03 Nov 2022 20:40:08 GMT

I have two inputs in the dashboard and I need to evaluate filed name and value to compare dynamically based on those inputs and filter events based on that. That is what I'm tryign to do.

Re: How to filter the results based on the evaluated field?

richgalloway — Thu, 03 Nov 2022 20:55:22 GMT

I hoping this was in a dashboard. If you have an input called "space" that holds a cf_space_name value then you can reference that token in the SPL.

index=XXXXXXXXX cf_space_name=$space$ YYYYYYYYYYYY | stats count

Re: How to filter the results based on the evaluated field?

yuanliu — Fri, 04 Nov 2022 06:08:23 GMT

I still don't see how "cf_space_name=production" is a dynamic input. In this form, it is just a static string. Can you explain? Maybe you can illustrate with data (anonymize as necessary)?