topic Re: How can I pass a variable to the tail command? in Splunk Search

How can I pass a variable to the tail command?

terryloar — Mon, 28 Sep 2020 18:21:08 GMT

...
| tail 200

works fine.
...
| eval tail_value=200
| tail tail_value

throws this error:
Error in 'tail' command: The number of results must be a positive number.

I've used tokens as the tail argument but a simple variable is not recognized. For example:
...
| tail $token_from_dropdown$

works.

We've written a cumbersome work-around, but I know I'm missing the simple solution.

Thanks.

jhupka — Wed, 10 Dec 2014 20:10:29 GMT

One possibility is to get the dynamic value via a subsearch:

index=_internal | tail [ | stats count | eval search=10 | fields search ]

That will effectively expand to a search that looks like this:

 index=_internal | tail ((10))

So in your case just come up with a subsearch that dynamically obtains your value.

terryloar — Thu, 11 Dec 2014 05:57:17 GMT

Good, simple solution. Thanks.