Splunk Search

Getting hold of an eval from subsearch

Path Finder


How do I do something like this in splunk?

eval base_starttime = [search index="app_event"| eval starttime = strftime(sometime, someformat) | return starttime] | (then use base_startime ....)

Basically I want to get hold of an eval in subsearch to use in my base search.

0 Karma


Try this as an example.

[search (your search)|eval earliest=_time-60 | eval latest=_time+60 | table earliest latest | format "(" "(" "" ")" "OR" ")" ] 
0 Karma

Path Finder

Could you explain your solution. I understand that singular values like count can be accessed and stored using return $count. How do we obtain list type values?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!