Can I use the result of an eval command as a token further down the line in my search?

[efferth]

Hey y'all,

I have a chart that takes transaction data from processes that run at different intervals. Most processes run once per day, but one runs once per week. The end goal is to show the duration taken for the process by taking the difference in the time stamps from the start event and end event. I want to be able to show all of the data in the same dashboard panel, and to do that I am trying to run a search that goes something like this:

index=google_search_appliance (("checkForOrphans") AND ("Checking for orphaned documents" OR "orphaned assets added to the transaction table")) 
|eval pause_duration= if(process="connectweb","6d","23h") 
|transaction process maxpause=$pause_duration$ 
|table process orphan_count duration pause_duration

Can I correlate an eval to a token like this or is it not possible?

Thanks!

[woodcock]

You can indeed execute an eval statement and put the results into a token. The XML syntax is like this:

<eval token="myToken">tostring(round('field'))</eval>

[javiergn · Accepted solution]

See if the following helps as an alternative (not the most efficient approach and not tested):

index=google_search_appliance (("checkForOrphans") AND ("Checking for orphaned documents" OR "orphaned assets added to the transaction table")) process="connectweb"
|transaction process maxpause=6d
|table process orphan_count duration pause_duration
| append [
    | search index=google_search_appliance (("checkForOrphans") AND ("Checking for orphaned documents" OR "orphaned assets added to the transaction table")) NOT process="connectweb"
    |transaction process maxpause=23h
    |table process orphan_count duration pause_duration
]

Or you can always try to replace transaction with stats, streamstats, etc:

https://answers.splunk.com/answers/53748/alternative-to-transaction-command.html
https://answers.splunk.com/answers/103/transaction-vs-stats-commands.html

There are more answers if you do a quick search.

[efferth]

The above search worked in my case! Thank you.

[javiergn]

No worries.
Please don't forget to mark it as answered in order to close this thread.

Thanks,
J