Splunk Search

Export dilldown search with variables substituted

shaquibk
Explorer

Hi Team,

I have a query related to drilldown searches of notables. I want to export/show results of drilldown searches with variables substituted corresponding to each notable.

Example, consider following search:
`notable` | search event_id="XXXXXX" | table drilldown_search,drilldown_earliest,drilldown_latest

The above search will give me drilldown search but with variables not substituted. I want the variables to be substituted in the search results.

Actual result of above search - index=abc action=failure user="$user$" 

Desired output - index=abc action=failure user="johndoe@example.com" 

Let me know if any further info is needed. Thanks in advance.

Regards,

Shaquib

Labels (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...