Splunk Search

Can I use the result of an eval command as a token further down the line in my search?

Path Finder

Hey y'all,

I have a chart that takes transaction data from processes that run at different intervals. Most processes run once per day, but one runs once per week. The end goal is to show the duration taken for the process by taking the difference in the time stamps from the start event and end event. I want to be able to show all of the data in the same dashboard panel, and to do that I am trying to run a search that goes something like this:

index=google_search_appliance (("checkForOrphans") AND ("Checking for orphaned documents" OR "orphaned assets added to the transaction table")) 
|eval pause_duration= if(process="connectweb","6d","23h") 
|transaction process maxpause=$pause_duration$ 
|table process orphan_count duration pause_duration

Can I correlate an eval to a token like this or is it not possible?

Thanks!

0 Karma
1 Solution

SplunkTrust
SplunkTrust

See if the following helps as an alternative (not the most efficient approach and not tested):

index=google_search_appliance (("checkForOrphans") AND ("Checking for orphaned documents" OR "orphaned assets added to the transaction table")) process="connectweb"
|transaction process maxpause=6d
|table process orphan_count duration pause_duration
| append [
    | search index=google_search_appliance (("checkForOrphans") AND ("Checking for orphaned documents" OR "orphaned assets added to the transaction table")) NOT process="connectweb"
    |transaction process maxpause=23h
    |table process orphan_count duration pause_duration
]

Or you can always try to replace transaction with stats, streamstats, etc:

https://answers.splunk.com/answers/53748/alternative-to-transaction-command.html
https://answers.splunk.com/answers/103/transaction-vs-stats-commands.html

There are more answers if you do a quick search.

View solution in original post

Esteemed Legend

You can indeed execute an eval statement and put the results into a token. The XML syntax is like this:

<eval token="myToken">tostring(round('field'))</eval>
0 Karma

SplunkTrust
SplunkTrust

See if the following helps as an alternative (not the most efficient approach and not tested):

index=google_search_appliance (("checkForOrphans") AND ("Checking for orphaned documents" OR "orphaned assets added to the transaction table")) process="connectweb"
|transaction process maxpause=6d
|table process orphan_count duration pause_duration
| append [
    | search index=google_search_appliance (("checkForOrphans") AND ("Checking for orphaned documents" OR "orphaned assets added to the transaction table")) NOT process="connectweb"
    |transaction process maxpause=23h
    |table process orphan_count duration pause_duration
]

Or you can always try to replace transaction with stats, streamstats, etc:

https://answers.splunk.com/answers/53748/alternative-to-transaction-command.html
https://answers.splunk.com/answers/103/transaction-vs-stats-commands.html

There are more answers if you do a quick search.

View solution in original post

Path Finder

The above search worked in my case! Thank you.

0 Karma

SplunkTrust
SplunkTrust

No worries.
Please don't forget to mark it as answered in order to close this thread.

Thanks,
J

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!