Splunk Search

Concatenate fields into string on form

timmy13
Communicator

I want a form that will allow a user to "build" the appropriate "source" (or log file name) based on selecting various pieces of data.

So the fields will be like this:

Date
Application
Server

I want to then build a string to use in the search.

Trying to use eval but getting now where....

sourcetype=MySourceType | eval sourcelog=Date."-".Application."-".Server.".log" |search source=sourcelog

This always returns 0 results. If I leave out the search function, the sourcelog field is populated.

Once I can get this search to work, I can use it in the populatingsearch function of the form.

Ideas?

hazekamp
Builder

When comparing two fields you want to use the where command instead:

sourcetype=MySourceType | eval sourcelog=Date."-".Application."-".Server.".log" | where source=sourcelog

timmy13
Communicator

Great hazekamp, thanks for the help. That works, but I still have a problem.

Of course, when defining source=, I can use wild cards. However, when I place wildcards into sourcelog, and then use the where source=sourcelog command, it fails. seems the where doesn't like wildcards.

Ideas?

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...