Reporting
Highlighted

how to pass savedsearch name as other search result.

Path Finder

hi all,
how to pass search result to savedsearch .
example
index="_internal" |eval a=one|table a

how to pass result "a" as saved search name like "|savedsearch "

Tags (1)
0 Karma
Highlighted

Re: how to pass savedsearch name as other search result.

SplunkTrust
SplunkTrust

Try something like this

|savedsearch [search index="_internal" |eval a=one|table a | return $a] | table *
0 Karma
Highlighted

Re: how to pass savedsearch name as other search result.

SplunkTrust
SplunkTrust

what error you're getting?

0 Karma