All Apps and Add-ons

append a variable to a search without results

sbsbb
Builder

I have a variable $var$, and want to display it a search result..

Whe I make
eval varSearch="test" | table varSearch

There are "no events found" how can I do that ?

Same problem when having a variable from upstream $var$ how can I use common eval function on that, and display it ?

0 Karma
1 Solution

sbsbb
Builder

side view provided an answer there
http://splunk-base.splunk.com/answers/83344/conditional-eval-resultsvaluesetter

In fact to add a row without results, we need a workaround by using a count, and hiding the field as :
| stats count | fields - count | eval

View solution in original post

0 Karma

sbsbb
Builder

side view provided an answer there
http://splunk-base.splunk.com/answers/83344/conditional-eval-resultsvaluesetter

In fact to add a row without results, we need a workaround by using a count, and hiding the field as :
| stats count | fields - count | eval

0 Karma

sbsbb
Builder

Does this is also supposed to work with a big xml $foo$ value ? I have a 1.3MB xml, I see it it Runtime debug, but I'm not pass it to the results, is it because of the quotes ?

I've tried with $foo$ and $foo.rawValue$...

0 Karma

kml_uvce
Builder

if there is any "test" in event then its comes in table in variable varSearch
-Kamal Bisht

0 Karma

sbsbb
Builder

I have no event at all, I want to affect a value to a new field, and see it as result ... Is that possible ?

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...