Splunk Search

Getting hold of an eval from subsearch

dhruv101
Path Finder

Hello,

How do I do something like this in splunk?

eval base_starttime = [search index="app_event"| eval starttime = strftime(sometime, someformat) | return starttime] | (then use base_startime ....)

Basically I want to get hold of an eval in subsearch to use in my base search.
Thanks.

0 Karma

HiroshiSatoh
Champion

Try this as an example.

[search (your search)|eval earliest=_time-60 | eval latest=_time+60 | table earliest latest | format "(" "(" "" ")" "OR" ")" ] 
0 Karma

dhruv101
Path Finder

Could you explain your solution. I understand that singular values like count can be accessed and stored using return $count. How do we obtain list type values?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...