- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Assign a string to a Variable in Search Bar
I would like to assign a string to a variable, like valid ="error" then use the variable with the stats or timechart parameters, I have used eval command which is not working, really not sure which inbuilt variable command will help.
index="SubProduct" sourcetype="access_log" "Error due to validation" | timechart count by host
Is it possible to assign the string to a variable like this
index="SubProduct" sourcetype="access_log" Valid = "Error due to validation" | timechart count(Valid) by host
I have used
eval valid ="Error due to validation" command which is not working in this case.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Does this help?
index="SubProduct" sourcetype="access_log" "Error due to validation" | rex (?"Error due to validation") | timechart count(Valid) by host
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I downvoted this post because misleading answer without structure.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How you brought up the count(Valid) command without creating a Valid variable ? I want to achieve something like, assign a string to the variable called 'Value' then have to count the 'Value', technically I am counting the similar repeated string.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

for some reason, I cannot put in the exact search string ... use your search and pipe it to rex as described here:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rex
Look at example 1. You are looking to create a single field, so use the first part of example 1. i got it to work, but for some reason, when I post my exact search string, it gets mashed up upon post.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Ok, if i understand you correct, you would like to dynamically extract Error messages from logs and assign it to a field? If yes, that is very much possible using eval
You could you regular expressions to extract the Error string and assign it to field
Syntax: ....|rex field=_raw "...(?P"Error...blah blah")" Refer: http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Rex
Using evals to look for Error and assign a generic value to the new Field. Example
Syntax: ....|eval Valid=if(match(_raw,"Error"),"Error","") etc (Endless possibilities here)
Hope this leads you where you want to be 🙂
Thanks,
Raghav
