How can i assign a value to a variable in a splunk

[Med_Ryad]

Hello everyone,

I am looking for a way to assign values to variables in order to avoid repetition in my query. I want to search in different resources using the same variables in the same query. I have tried the following, but it does not seem to work:

| makeresults
| eval var_1="var_1_content"
| eval var_2="var_2_content"
| search (sourcetype=var_1 OR sourcetype=var_2)

Could you please help me correct this or provide an alternative approach to achieve this? Thank you for your assistance!

[ITWhisperer]

It is a bit unclear what it is you are trying to do but perhaps this approach might help you

index=main [! makeresults
  | eval sourcetype=split("var_1_content,var_2_content",",")
  | mvexpand sourcetype
  | table sourcetype]

[Med_Ryad]

hi @ITWhisperer  , thanks for your answer  , 

I have the following query:

(sourcetype="mysource1" OR sourcetype="mysource2") AND (Node__name="myserver_name" OR (object__Name="myserver_name*") OR (location__Name="*myserver_name*"))

What I am trying to achieve is to assign the value "myserver_name" to a variable (e.g., servername) in order to avoid repetition. This way, if I need to modify the query, I only have to update the declared variable. I am looking for something like this:

| eval servername = "myserver_name"
(sourcetype="mysource1" OR sourcetype="mysource2") AND (Node__name=servername OR (object__Name=servername) OR (location__Name=servername))

This would allow me to use the variable servername instead of repeating the value "myserver_name" multiple times in the query.

i hope that it's clear now !

[ITWhisperer · Accepted solution]

Try something like this

(sourcetype="mysource1" OR sourcetype="mysource2") [| makeresults
| eval servername="myserver_name"
| eval Node__name=servername
| eval object__Name=servername."*"
| eval location__Name=servername."*"
| format "" "" "OR" "" "" ""]

[Med_Ryad]

Perfect ! thank you so much !