Help with foreach on REST endpoint data

[andrew_nelson]

I'm trying to get a list of fields by sourcetype without going down the route of fieldsummary and thought analyzing the props configs would be a good place to start. 

I'm starting with EVAL generated fields but not having any luck on the foreach section.
Any pointers would be much appreciated.

| rest splunk_server=local /servicesNS/-/-/configs/conf-props 
| table title EVAL-a* 
| eval eval_fields="" 
| foreach EVAL-* 
    [ eval eval_fields=if(isnotnull(<<FIELD>>), mvappend(eval_fields,'<<MATCHSTR>>'), eval_fields) ] 
| table title eval_fields *

[richgalloway]

You're very close.  The <<FIELD>> specifier should be enclosed in single quotes so Splunk treats "EVAL-action" as a field name instead of an expression.  Also, <<MATCHSTR>> should be in double quotes so the string "action" rather than the non-existent field 'action' is appended to eval_fields.

| rest splunk_server=local /servicesNS/-/-/configs/conf-props 
| fields title EVAL-a* 
| eval eval_fields="" 
| foreach EVAL-*
    [ eval eval_fields=if(isnotnull('<<FIELD>>'), mvappend(eval_fields,"<<MATCHSTR>>"), eval_fields) ] 
| table title eval_fields *

[andrew_nelson]

Thanks Rich. I was thinking along the lines of putting anything in double quotes would be interpreted literally so <<MATCHSTR>> would have ended up in my multivalue field. 
Thanks for the detailed explanation. 

[richgalloway]

Understood.  Like $tokens$ in dashboards and the map command, <<tokens>> in foreach are always expanded, even when quoted.

[kamlesh_vaghela · Accepted solution]

@andrew_nelson 

Can you please try this in foreach?

[ eval eval_fields= if(isnotnull('<<FIELD>>'), mvappend(eval_fields,"<<MATCHSTR>>"), eval_fields) ]

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

[andrew_nelson]

You're a legend KV  ! Thanks a million.
Been annoying me all day trying to figure out this. 

[kamlesh_vaghela]

😊😍