Splunk Enterprise

Help with foreach on REST endpoint data

andrew_nelson
Communicator

I'm trying to get a list of fields by sourcetype without going down the route of fieldsummary and thought analyzing the props configs would be a good place to start. 

I'm starting with EVAL generated fields but not having any luck on the foreach section.
Any pointers would be much appreciated.

 

| rest splunk_server=local /servicesNS/-/-/configs/conf-props 
| table title EVAL-a* 
| eval eval_fields="" 
| foreach EVAL-* 
    [ eval eval_fields=if(isnotnull(<<FIELD>>), mvappend(eval_fields,'<<MATCHSTR>>'), eval_fields) ] 
| table title eval_fields *

 

Labels (1)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@andrew_nelson 

Can you please try this in foreach?

[ eval eval_fields= if(isnotnull('<<FIELD>>'), mvappend(eval_fields,"<<MATCHSTR>>"), eval_fields) ]

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

You're very close.  The <<FIELD>> specifier should be enclosed in single quotes so Splunk treats "EVAL-action" as a field name instead of an expression.  Also, <<MATCHSTR>> should be in double quotes so the string "action" rather than the non-existent field 'action' is appended to eval_fields.

| rest splunk_server=local /servicesNS/-/-/configs/conf-props 
| fields title EVAL-a* 
| eval eval_fields="" 
| foreach EVAL-*
    [ eval eval_fields=if(isnotnull('<<FIELD>>'), mvappend(eval_fields,"<<MATCHSTR>>"), eval_fields) ] 
| table title eval_fields *

 

---
If this reply helps you, Karma would be appreciated.

andrew_nelson
Communicator

Thanks Rich. I was thinking along the lines of putting anything in double quotes would be interpreted literally so <<MATCHSTR>> would have ended up in my multivalue field. 
Thanks for the detailed explanation. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Understood.  Like $tokens$ in dashboards and the map command, <<tokens>> in foreach are always expanded, even when quoted.

---
If this reply helps you, Karma would be appreciated.
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@andrew_nelson 

Can you please try this in foreach?

[ eval eval_fields= if(isnotnull('<<FIELD>>'), mvappend(eval_fields,"<<MATCHSTR>>"), eval_fields) ]

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

andrew_nelson
Communicator

You're a legend KV  ! Thanks a million.
Been annoying me all day trying to figure out this. 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

😊😍

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...