topic Re: How can I use a variable as parameter for a custom command? in Splunk Search

How can I use a variable as parameter for a custom command?

HustenHelmut334 — Tue, 17 Feb 2015 15:12:15 GMT

This is not working: Is there a special syntax to use the content of a variable an not its name?

sourcetype="test"
|stats
|eval minute=tonumber(strftime(_time,"%M"))
|eval foo=250
|eval th=if(minute > 30,"foo=100:200","foo=0:0")
|addinfo
|mycustomcommand monitor=test defaults="foo=150" thresholds=th

This working:

|mycustomcommand monitor=test defaults="foo=150" thresholds="foo=100:200"

Why is th not evaluated?

Re: How can I use a variable as parameter for a custom command?

woodcock — Thu, 18 Apr 2019 12:38:30 GMT

Try this:

sourcetype="test"
|stats
|eval minute=tonumber(strftime(_time,"%M"))
|eval foo="250"
|eval th=if(minute > 30,"foo=100:200","foo=0:0")
|addinfo
| map search="|mycustomcommand monitor=test defaults=\"foo=$foo$\" thresholds=\"$th$\""

Re: How can I use a variable as parameter for a custom command?

woodcock — Thu, 18 Apr 2019 12:39:25 GMT

Try this @spammenot66 and @HustenHelmut334.