topic Re: How do I use a value of an eval field to search an existing field in Splunk Search

How do I use a value of an eval field to search an existing field

apvinod2003 — Tue, 29 Sep 2020 09:14:02 GMT

Hi Experts,

I have an input token $env_field$ which has a value: "port123_host123"
host, component and port are existing fields in splunk

I have a search that goes as follows: (basically need to extract the port from input token and use that value to search on the port field)

host=host123 component=cmp123| eval prtInput= replace($env_field$, "([^_]+)\_\w*", "\1")  | search port=prtInput

But this doesn't work. Eval expression is working, i.e., prtInput gets evaluated as "port123" and available as a field in the search result; I checked. But the search port=prtInput portion isn't returning any results somehow. search port=port123 returns results however.

Can't we use a value from eval field piped into a search command? If not, what alternatives do we have to achieve this?

Regards,
Vinod.

Re: How do I use a value of an eval field to search an existing field

jacobwilkins — Thu, 31 Mar 2016 13:58:05 GMT

Change:

| search port=prtInput

| where port==prtInput

Re: How do I use a value of an eval field to search an existing field

apvinod2003 — Thu, 31 Mar 2016 14:11:49 GMT

That worked like a charm :). Thanks a lot.

Re: How do I use a value of an eval field to search an existing field

ddrillic — Thu, 31 Mar 2016 14:38:11 GMT

Tried to find some related threads such as https://answers.splunk.com/answers/50659/whats-the-difference-between-where-and-search-in-the-pipeline.html