spath and lookup table to switch the path argument

[secuc2r83]

Hello,

(splunk entreprise 6.6.3)

In a dropdown menu, when i select an application, i need to parse and print a value from an xml field
Problem: This value don't have the same name and xml path.
Solution: Use a lookup table to store APP -> PATH.NAME:

a.csv
        device,pathname
        app1, dir1.dir2.dir3.dir4.param_value
        app2, dir.param_data
        app3, dir1.dir2.dir3.param_name

When i test my request with the xml path, it's working:

device=app3 | JOIN type=inner device [ | inputlookup a.csv ] | spath input=xmlfield output=param_name path=dir1.dir2.dir3.param_name | table device, data

        device,     data
        app3        param_name

But impossible when i call the lookup table's field content $pathname$:

device=app3 | JOIN type=inner device [ | inputlookup a.csv ] | spath input=xmlfield output=param_name path=$pathname$ | table device, data

            device,     data        
            app3            

To be sure that i grab the pathname from lookup table, i put it in a test variable and same result:

device=app3 | JOIN type=inner device [ | inputlookup a.csv ] | eval test=$pathname$ | spath input=xmlfield output=param_name path=$pathname$ | table device, data, test

            device,     data        test
            app3                    dir1.dir2.dir3.param_name

In other post i see: "The spath command cannot accept a variable for the path - it treats unquoted paths as literals"
=> Then i put xml path in quotes... but same result.

If someone have an idea, solution or alternative it will be great.

Thanks in advance.

[hardikJsheth · Accepted solution]

In your scenario you should use return command. You can try rewriting your query as follows:

device=app3 | spath input=xmlfield output=param_name [|inputlookup a.csv where device=app3 | eval path="path=\""+ pathname + "\"" | return $path ] | table device, data, test

[secuc2r83]

Thanks to hardikJsheth , it's working.
The clue was to "return" the variable in the subsearch.
kind Regards