topic Re: How to concatenate a string with a variable? in Splunk Search

How to concatenate a string with a variable?

buttsurfer — Thu, 12 Jan 2023 21:51:48 GMT

I want to run this search but i have to concatenate the string with a variable and it doesn't work

| rest splunk_server=local /servicesNS/-/-/saved/searches
| where match(search,"outputlookup\s.$lookup$")

Re: How to concatenate a string with a variable?

richgalloway — Thu, 12 Jan 2023 22:04:48 GMT

I showed you how to do that this morning.

https://community.splunk.com/t5/Splunk-Search/How-to-append-the-result-of-a-search-to-values-of-a-multivalued/m-p/626926#M217875

Re: How to concatenate a string with a variable?

buttsurfer — Thu, 12 Jan 2023 22:37:59 GMT

The $lookup$ variable is a token from the dashboard drilldown

Re: How to concatenate a string with a variable?

bowesmana — Thu, 12 Jan 2023 23:13:46 GMT

Based on the comments in your original post - (try not to create multiple posts with different info, it makes it hard for people to help) - I understand you have a token that has multiple values.

If that $lookup$ token is created through a <set token="lookup"> statement in the drilldown and the original field is MV, then the token will concatenate those values and look like

a,b,c,d

so to do the match you would have to to something like (untested)

| rest splunk_server=local /servicesNS/-/-/saved/searches | eval lookups="(".replace($lookup$, ",", "\|").")" | where match(search,"outputlookup\s".lookups)

which effectively is turning a,b,c,d into (a|b|c|d) and then the match will be doing

| where match(search,"outputlookup\s(a|b|c|d)")

Re: How to concatenate a string with a variable?

buttsurfer — Fri, 13 Jan 2023 08:09:53 GMT

This doesn't seem to work and the field is not a MV

Re: How to concatenate a string with a variable?

yuanliu — Fri, 13 Jan 2023 08:49:24 GMT

Pro tip (to get help from volunteers): Describe/illustrate your data (anonymize as needed but explain any characteristics others need to know) and desired output; describe the logic connecting your data and desired results (short, simple sample code/pseudo code is fine); if you have tried sample code, illustrate output and explain why it differs from desired results.

From the OP to this, there is only one piece of sample code and an explanation that the token in the sample is not itself multivalued. Unless you provide the rest of information, "it doesn't work" conveys absolutely no information. In fact, avoid this phrase like a plague even at the best of times.