topic Re: How to search based on variable? | search no = variable in Splunk Search

How to search based on variable? | search no = variable

LearningGuy — Wed, 20 Mar 2024 12:53:54 GMT

Hello,

How to search based on variable?

If select contains "many", then search no IN (1 to 30), else search NO 7

| eval variable = if(select="many", "(1-30)", "7")

| search no IN variable ==> This doesn't work

| search no IN (7) ==> This works

| search no IN (1,2,3,4,5,6,7,8,9,10,11) ==> This works, but I have to manually put the number

| where variable IN (1,2,3,4,5,6,7,8,9,10,11) ==> This does not work ( although the Splunk documentation said it should work) https://docs.splunk.com/Documentation/SCS/current/SearchReference/WhereCommandOverview

| regex no= "([1-30])" ==> This works

| regex no = variable ==> This does not work (variable)

Thank you for your help

Re: How to search based on variable? | search no = variable

isoutamo — Wed, 20 Mar 2024 13:41:22 GMT

as you can see this depends on case. You must also understand that SPL is not a programming language and for that reason it works differently than those.

What is your use case / issue which you are trying to solve?

r. Ismo

Re: How to search based on variable? | search no = variable

LearningGuy — Wed, 20 Mar 2024 14:34:11 GMT

Hello,
I need to filter using search based on a condition
instead of | search no = "abc" I need to make "abc" as a variable

Thanks,

Marius

Re: How to search based on variable? | search no = variable

isoutamo — Wed, 20 Mar 2024 15:15:45 GMT

You didn't tell what is your issue. You just told how you are trying to solve it! In splunk there are usually several ways to solve those and some are much better that other. Usually people whom are not familiar with splunk try to use the second option ....

You can see e.g. https://community.splunk.com/t5/Splunk-Search/How-to-return-a-single-value-from-a-subsearch-into-eval/m-p/681377#M232833 how to use "variables" on search etc.

Re: How to search based on variable? | search no = variable

LearningGuy — Wed, 20 Mar 2024 15:20:02 GMT

Thanks for your suggestion
I tried to simplify, but this is what I am trying to solve:

https://community.splunk.com/t5/Splunk-Search/How-to-search-based-on-drop-down-condition/m-p/681366#M232829

Re: How to search based on variable? | search no = variable

isoutamo — Wed, 20 Mar 2024 15:30:46 GMT

Again you just told how you are trying to solve something, but you didn't tell what is your real issue?

Could you describe what you are looking with this dashboard?