topic How to add dynamic value in search query? in Splunk Search

How to add dynamic value in search query?

s0k0 — Thu, 11 May 2023 02:07:05 GMT

I have created a post curl to add data in Splunk, internally my api hits Splunk api and in that api I send data in body & that data would get created in my splunk table.
I want to add dynamic value in search query of splunk api.
How can i achieve that, please help here

method: "POST",

path: "/api/addSplunk",

handler: async (request, h) => {

const ccmData = getServerConfig(request);

const url = ccmData["splunkApiUrl"];

const ChannelName= request.payload.channel_name; // I want to use this value in search query

const Channel= request.payload.channel_type;

function xmlTranslate(resp) {

return resp.text()

}

const httpsAgent = new https.Agent({

rejectUnauthorized: false

});

const options = {

method: "POST",

headers: {

"Authorization": "dr356654fy6,

"Content-Type": "application/x-www-form-urlencoded"

agent: httpsAgent,

translate: xmlTranslate,

};

const res = await fetch(url, options, xmlTranslate);

Right now I have hardcoded like this eval Channel ="372864u31564719" | eval ChannelName = "4P customer", I want to add dynamic value for diff use case in channel and channelName of search query (i.e coming from request payload)

Re: How to add dynamic value in search query?

TrangCIC81 — Thu, 11 May 2023 06:32:25 GMT

To add dynamic values to your Splunk search query, you can use string interpolation. Here's an example of how you can modify your code to use the values from the request payload.
Let me know if it works.

method: "POST", path: "/api/addSplunk", handler: async (request, h) => { const ccmData = getServerConfig(request); const url = ccmData["splunkApiUrl"]; const ChannelName = request.payload.channel_name; const Channel = request.payload.channel_type; function xmlTranslate(resp) { return resp.text() } const httpsAgent = new https.Agent({ rejectUnauthorized: false }); // Use string interpolation to insert dynamic values in the search query const query = `| makeresults | eval Channel="${Channel}" | eval ChannelName="${ChannelName}" | table Channel,ChannelName | outputlookup channel.csv append=true`; const options = { method: "POST", headers: { "Authorization": "dr356654fy6", "Content-Type": "application/x-www-form-urlencoded" }, agent: httpsAgent, translate: xmlTranslate, body: `search=${encodeURIComponent(query)}` };

Re: How to add dynamic value in search query?

VatsalJagani — Thu, 11 May 2023 06:43:49 GMT

@s0k0 - You can use query with variables, something like this:

Kindly upvote if you find it useful!!!

Re: How to add dynamic value in search query?

s0k0 — Thu, 11 May 2023 08:00:12 GMT

Hi @TrangCIC81 I tried this, didn't work.

@VatsalJagani thank you so much, it works !!

Re: How to add dynamic value in search query?

TrangCIC81 — Thu, 11 May 2023 08:04:52 GMT

Can you verify if the values for ChannelName and Channel do not contain any special characters that might interfere with the construction of the string in the body of the request?

Also try logging the values of ChannelName and Channel to the console to verify that they are being properly read.

Re: How to add dynamic value in search query?

s0k0 — Thu, 11 May 2023 08:11:53 GMT

Yes, it doesn't have any special character, inside options object ChannelName and Channel value is not getting read.

Outside option object it's value is getting read, I did console and check.
So I put whole query outside the option object then get the dynamic value and append in body

const query = `| makeresults | eval Channel="${Channel}" | eval ChannelName="${ChannelName}" | table Channel,ChannelName | outputlookup channel.csv append=true`;

const options = {

method: "POST",

headers: {

"Authorization": authToken,

"Content-Type": "application/x-www-form-urlencoded"

agent: httpsAgent,

translate: xmlTranslate,

body: `search=${query}`

};

This works !!

Thank you so much for resolving.

Re: How to add dynamic value in search query?

TrangCIC81 — Thu, 11 May 2023 08:16:13 GMT

Ah ok. No problem.
Cheers!!

Re: How to add dynamic value in search query?

VatsalJagani — Thu, 11 May 2023 11:26:34 GMT

@s0k0 - I'm glad that it works!! Kindly consider accepting my answer which helped you resolve your question, so that other community members can easily see it.