topic Re: Is it possible to pass an eval value to table command? in Splunk Search

Is it possible to pass an eval value to table command?

raymondc — Thu, 31 Aug 2017 13:34:41 GMT

Hi,

I have a string with fields that I want to show in a table. (eval -> my_fields)

This is my search:

| makeresults 
| eval my_fields ="field_a field_b"
| eval field_a ="My Value A", field_b ="Other Value B" 
| table my_fields

And this is my search output:

my_fields
field_a field_b

But I want my result to be like this:

 field_a    | field_b
 My Value A | Other Value B

How can I do this?

Re: Is it possible to pass an eval value to table command?

somesoni2 — Thu, 31 Aug 2017 13:57:44 GMT

You can't pass a field value to a table command, but since your field names (in your sample search) are static, you can use subsearch like this to achieve the same.

| makeresults 
 | eval field_a ="My Value A", field_b ="Other Value B" 
 | table [|makeresults |  eval search ="field_a field_b" | table search ]

The 'search' is a special field name which will return the string value from the subsearch

Re: Is it possible to pass an eval value to table command?

DalJeanis — Thu, 31 Aug 2017 23:49:00 GMT

You want to have one field that will determine which other fields will be displayed.

Two easy ways, the first describing @somesoni2's above...

your first search that gets values of fieldA and fieldB and potentially other fields
| table [ search your second search that returns names of fieldA and fieldB in a field named search as the only field ]

.. . or the alternate...

your second search that returns names of fieldA and fieldB in a field named foo (and we dont care how many other fields) 
| map search="search your first search that gets values of fieldA, field B and potentially other fields | table $foo$"