Splunk Search

Hi All, how can i take result (which is a macro ) of inputlookup table and use that result to extract data from the macro ??

Anantha123
Communicator

| inputlookup ED_ENDI_Digital_Flow
| search Flow="ED_ENDI_FLOW_"
| search Step="ED_ENDI_STEP
"
| rex field=Step "ED_ENDI_STEP_(?\w+)"
| stats values(Title1) as titleVals
| eval hostFilter="(ED_ENDI_STEP_".mvjoin(titleVals, ") OR (ED_ENDI_STEP_").")"
| fields hostFilter

host filter will have list of macros as a result as below format

o/p - (macro1) OR ('macro2') OR (macro3) .....

I want value of hostFilter to be appeared in below query to use the values in these macros (results of hostFilters)

index=* ***(hostFilter macros i.e (macro1) OR ('macro2') OR (macro3) .... ) | stats count as Total

Tags (1)
0 Karma
1 Solution

Anantha123
Communicator

We can use Base search for Inputlookup query and link the result to Panel query by using data element

<query>

| inputlookup ED_ENDI_Digital_Flow
| search Flow="ED_ENDI_FLOW_"
| search Step="ED_ENDI_STEP
"
| rex field=Step "ED_ENDI_STEP_(?\w+)"
| stats values(Title1) as titleVals
| eval hostFilter="(ED_ENDI_STEP_".mvjoin(titleVals, ") OR (ED_ENDI_STEP_").")"
| fields hostFilter

<earliest>$Time.earliest$</earliest>
<latest>$Time.latest$</latest>
<done>
  <set token="ABC">$result.finaldata$</set>
</done>



<panel>
  <table>
    <title>test $ABC$</title>
    <search>
      <query>index=* $ABC$ |stats  count AS Total </query>
      <earliest>$Time.earliest$</earliest>
      <latest>$Time.latest$</latest>
    </search>
    <option name="drilldown">none</option>
  </table>
</panel>

View solution in original post

0 Karma

Anantha123
Communicator

We can use Base search for Inputlookup query and link the result to Panel query by using data element

<query>

| inputlookup ED_ENDI_Digital_Flow
| search Flow="ED_ENDI_FLOW_"
| search Step="ED_ENDI_STEP
"
| rex field=Step "ED_ENDI_STEP_(?\w+)"
| stats values(Title1) as titleVals
| eval hostFilter="(ED_ENDI_STEP_".mvjoin(titleVals, ") OR (ED_ENDI_STEP_").")"
| fields hostFilter

<earliest>$Time.earliest$</earliest>
<latest>$Time.latest$</latest>
<done>
  <set token="ABC">$result.finaldata$</set>
</done>



<panel>
  <table>
    <title>test $ABC$</title>
    <search>
      <query>index=* $ABC$ |stats  count AS Total </query>
      <earliest>$Time.earliest$</earliest>
      <latest>$Time.latest$</latest>
    </search>
    <option name="drilldown">none</option>
  </table>
</panel>
0 Karma

richgalloway
SplunkTrust
SplunkTrust

@Anantha123 Is your problem resolved? If so, please accept the answer to help future readers.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Anantha123
Communicator

Yes, with above code. I am able to get the result of base search dragged in to the panel query

0 Karma