Assign a string to a Variable in Search Bar

[vkakani60]

I would like to assign a string to a variable, like valid ="error" then use the variable with the stats or timechart parameters, I have used eval command which is not working, really not sure which inbuilt variable command will help.

  index="SubProduct" sourcetype="access_log" "Error due to validation" | timechart count by host

Is it possible to assign the string to a variable like this

  index="SubProduct" sourcetype="access_log" Valid = "Error due to validation" | timechart count(Valid) by host

I have used
eval valid ="Error due to validation" command which is not working in this case.

[sshelly_splunk]

Does this help?
index="SubProduct" sourcetype="access_log" "Error due to validation" | rex (?"Error due to validation") | timechart count(Valid) by host

[vkakani60]

I downvoted this post because misleading answer without structure.

[vkakani60]

How you brought up the count(Valid) command without creating a Valid variable ? I want to achieve something like, assign a string to the variable called 'Value' then have to count the 'Value', technically I am counting the similar repeated string.

[sshelly_splunk]

for some reason, I cannot put in the exact search string ... use your search and pipe it to rex as described here:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rex
Look at example 1. You are looking to create a single field, so use the first part of example 1. i got it to work, but for some reason, when I post my exact search string, it gets mashed up upon post.

[Raghav2384]

Ok, if i understand you correct, you would like to dynamically extract Error messages from logs and assign it to a field? If yes, that is very much possible using eval

You could you regular expressions to extract the Error string and assign it to field
Syntax: ....|rex field=_raw "...(?P"Error...blah blah")" Refer: http://docs.splunk.com/Documentation/Splunk/4.3/SearchReference/Rex

Using evals to look for Error and assign a generic value to the new Field. Example

Syntax: ....|eval Valid=if(match(_raw,"Error"),"Error","") etc (Endless possibilities here)

Hope this leads you where you want to be 🙂

Thanks,
Raghav