Getting Data In

How can i assign a value to a variable in a splunk

Med_Ryad
Engager

Hello everyone,

I am looking for a way to assign values to variables in order to avoid repetition in my query. I want to search in different resources using the same variables in the same query. I have tried the following, but it does not seem to work:

| makeresults
| eval var_1="var_1_content"
| eval var_2="var_2_content"
| search (sourcetype=var_1 OR sourcetype=var_2)

Could you please help me correct this or provide an alternative approach to achieve this? Thank you for your assistance!

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

(sourcetype="mysource1" OR sourcetype="mysource2") [| makeresults
| eval servername="myserver_name"
| eval Node__name=servername
| eval object__Name=servername."*"
| eval location__Name=servername."*"
| format "" "" "OR" "" "" ""]

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is a bit unclear what it is you are trying to do but perhaps this approach might help you

index=main [! makeresults
  | eval sourcetype=split("var_1_content,var_2_content",",")
  | mvexpand sourcetype
  | table sourcetype]
0 Karma

Med_Ryad
Engager

hi @ITWhisperer  , thanks for your answer  , 

I have the following query:

(sourcetype="mysource1" OR sourcetype="mysource2") AND (Node__name="myserver_name" OR (object__Name="myserver_name*") OR (location__Name="*myserver_name*"))

What I am trying to achieve is to assign the value "myserver_name" to a variable (e.g., servername) in order to avoid repetition. This way, if I need to modify the query, I only have to update the declared variable. I am looking for something like this:

| eval servername = "myserver_name"
(sourcetype="mysource1" OR sourcetype="mysource2") AND (Node__name=servername OR (object__Name=servername) OR (location__Name=servername))

This would allow me to use the variable servername instead of repeating the value "myserver_name" multiple times in the query.

i hope that it's clear now !

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

(sourcetype="mysource1" OR sourcetype="mysource2") [| makeresults
| eval servername="myserver_name"
| eval Node__name=servername
| eval object__Name=servername."*"
| eval location__Name=servername."*"
| format "" "" "OR" "" "" ""]
0 Karma

Med_Ryad
Engager

Perfect ! thank you so much !

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...