Splunk Search

Assign a string to a Variable in Search Bar

vkakani60
Path Finder

I would like to assign a string to a variable, like valid ="error" then use the variable with the stats or timechart parameters, I have used eval command which is not working, really not sure which inbuilt variable command will help.

  index="SubProduct" sourcetype="access_log" "Error due to validation" | timechart count by host

Is it possible to assign the string to a variable like this

  index="SubProduct" sourcetype="access_log" Valid = "Error due to validation" | timechart count(Valid) by host

I have used
eval valid ="Error due to validation" command which is not working in this case.

Tags (1)
0 Karma

sshelly_splunk
Splunk Employee
Splunk Employee

Does this help?
index="SubProduct" sourcetype="access_log" "Error due to validation" | rex (?"Error due to validation") | timechart count(Valid) by host

0 Karma

vkakani60
Path Finder

I downvoted this post because misleading answer without structure.

0 Karma

vkakani60
Path Finder

How you brought up the count(Valid) command without creating a Valid variable ? I want to achieve something like, assign a string to the variable called 'Value' then have to count the 'Value', technically I am counting the similar repeated string.

0 Karma

sshelly_splunk
Splunk Employee
Splunk Employee

for some reason, I cannot put in the exact search string ... use your search and pipe it to rex as described here:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rex
Look at example 1. You are looking to create a single field, so use the first part of example 1. i got it to work, but for some reason, when I post my exact search string, it gets mashed up upon post.

0 Karma

Raghav2384
Motivator

Ok, if i understand you correct, you would like to dynamically extract Error messages from logs and assign it to a field? If yes, that is very much possible using eval

You could you regular expressions to extract the Error string and assign it to field
Syntax: ....|rex field=_raw "...(?P"Error...blah blah")" Refer: http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Rex

Using evals to look for Error and assign a generic value to the new Field. Example

Syntax: ....|eval Valid=if(match(_raw,"Error"),"Error","") etc (Endless possibilities here)

Hope this leads you where you want to be :slightly_smiling_face:

Thanks,
Raghav

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...