Splunk Enterprise

Help with foreach on REST endpoint data

andrew_nelson
Communicator

I'm trying to get a list of fields by sourcetype without going down the route of fieldsummary and thought analyzing the props configs would be a good place to start. 

I'm starting with EVAL generated fields but not having any luck on the foreach section.
Any pointers would be much appreciated.

 

| rest splunk_server=local /servicesNS/-/-/configs/conf-props 
| table title EVAL-a* 
| eval eval_fields="" 
| foreach EVAL-* 
    [ eval eval_fields=if(isnotnull(<<FIELD>>), mvappend(eval_fields,'<<MATCHSTR>>'), eval_fields) ] 
| table title eval_fields *

 

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@andrew_nelson 

Can you please try this in foreach?

[ eval eval_fields= if(isnotnull('<<FIELD>>'), mvappend(eval_fields,"<<MATCHSTR>>"), eval_fields) ]

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You're very close.  The <<FIELD>> specifier should be enclosed in single quotes so Splunk treats "EVAL-action" as a field name instead of an expression.  Also, <<MATCHSTR>> should be in double quotes so the string "action" rather than the non-existent field 'action' is appended to eval_fields.

| rest splunk_server=local /servicesNS/-/-/configs/conf-props 
| fields title EVAL-a* 
| eval eval_fields="" 
| foreach EVAL-*
    [ eval eval_fields=if(isnotnull('<<FIELD>>'), mvappend(eval_fields,"<<MATCHSTR>>"), eval_fields) ] 
| table title eval_fields *

 

---
If this reply helps you, Karma would be appreciated.

andrew_nelson
Communicator

Thanks Rich. I was thinking along the lines of putting anything in double quotes would be interpreted literally so <<MATCHSTR>> would have ended up in my multivalue field. 
Thanks for the detailed explanation. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Understood.  Like $tokens$ in dashboards and the map command, <<tokens>> in foreach are always expanded, even when quoted.

---
If this reply helps you, Karma would be appreciated.
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@andrew_nelson 

Can you please try this in foreach?

[ eval eval_fields= if(isnotnull('<<FIELD>>'), mvappend(eval_fields,"<<MATCHSTR>>"), eval_fields) ]

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

andrew_nelson
Communicator

You're a legend KV  ! Thanks a million.
Been annoying me all day trying to figure out this. 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

😊😍

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...