Using variable

jimjohn — Wed, 26 Feb 2014 09:12:14 GMT

My search string is
(host=ABC AND "Emp Code"=inputString) OR (host=joinHost AND "EMPLOYER_CODE"=inputString)
Can I have a common varible in place of inputString.

I tried using using eval like below.
eval inupt=inputString|(host=ABC AND "Emp Code"=inputString) OR (host=joinHost AND "EMPLOYER_CODE"=inputString)
But not getting result.

Any help

Re: Using variable

kristian_kolb — Wed, 26 Feb 2014 09:46:27 GMT

No, not the way you describe it.

You cannot start with an eval that way. You might get away with something like;

host=ABC OR host=joinHost inputString | blah blah blah

Which will search through the events for inputString, regardless of whether it appears in a field or not. But since inputString is treated as a literal string, rather than a field value, your search may return results where inputString is present in other parts of the event.

topic Using variable in Splunk Search

Using variable

Re: Using variable