Splunk Enterprise

Use eval field inside append search

mad_splunker
New Member

Hello Splunkers,

I am trying below query -

 

index=someindex cluster=gw uuid=gw98037234c6e51a48816016172b8a3c56
| eval api_uuid="gw"+reqid
| head 1
| append [search index=someindex cluster=api uuid=api_uuid]

 

Basically what I am trying is to get result from first search, evaluate new field from first search and add it as condition to second search. It is not working if I supply api_uuid field but If I replace uuid in append with actual computed value it is returning proper result. I have seen few people using join but dont want to use join as its expensive and comes with limit. Any solution to above query ?

Labels (1)
Tags (2)
0 Karma

mad_splunker
New Member

Nope not working

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@mad_splunker 

index=someindex cluster=api uuid=api_uuid [ search index=someindex cluster=gw uuid=gw98037234c6e51a48816016172b8a3c56 | eval uuid="gw"+reqid  | table uuid ]

 

Can you please try this? I have used different approach. 

 

thanks

KV

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...