topic assign value from another eval param in Splunk Search

assign value from another eval param

eranhauser — Tue, 10 Oct 2023 19:13:48 GMT

How to assign the value of param name original to the source in the | collect statement
index=123

| eval original=abcd,

| collect index=qaz source=original

Re: assign value from another eval param

PickleRick — Tue, 10 Oct 2023 19:10:02 GMT

Like with a programming language (writing searches in SPL is a form of programming after all), the order of operations does matter.

| eval a=b,c=a

will yield different results than

| eval c=a,a=b

Re: assign value from another eval param

eranhauser — Tue, 10 Oct 2023 19:14:46 GMT

I edited my question. That works in two eval parameters but not on the source parameter in the | collect

Re: assign value from another eval param

PickleRick — Tue, 10 Oct 2023 19:20:11 GMT

No. You can't do that. You need a constant parameter for the collect command. If you want to generate it dynamically, you need to do a subsearch from which you return the value of the parameter (the subsearch is executed before the main search).

Another option is to use the collect command with output_format=hec - then you can specify your metadata fields on a per-event basis but that's more complicated.

See https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Collect

Collect is generally a relatively tricky command with some non-obvious restrictions (and uses your license if you use sourcetype different than the default stash one) so it's worth reading thoroughly the docs about it and test it on a dev environment before trying to run it in prod.

Re: assign value from another eval param

eranhauser — Tue, 10 Oct 2023 19:46:37 GMT

Unfortunately it does not work. using sub search will change the query source value but not the collect one

Re: assign value from another eval param

PickleRick — Fri, 13 Oct 2023 18:40:05 GMT

More words please.

Subsearch is getting executed (and its results are substituted) where it's placed. So if you do

collect [...] sourcetype=[whatever subsearch you come up with]

It will work.

But that will give you one static value for the whole collect command.

If you want to dynamically assign the "destination" sourcetype per each event separately, you must use the hec format.