Splunk Search

How can I assign a field value to a variable using eval?

mjlsnombrado
Communicator

I want to assign a specific field value to a variable I want to do something like this:

|eval output = ('Fieldname'=fieldvalue)
Tags (3)
0 Karma

smoir_splunk
Splunk Employee
Splunk Employee
0 Karma

493669
Super Champion

Try this:

...| eval splitted=split(Field, "and")|eval output =mvindex(splitted,1)

Try this run anywhere search:

|makeresults|eval Field="A and  B"| eval splitted=split(Field, "and")|eval output =mvindex(splitted,1)
0 Karma

MuS
Legend

Hi mjlsnombrado,

If I understand your question correct, you can do this:

.... | eval output=fieldname

But if you actually want to use a value of a field as new field name, you can do this:

.... | eval foo="bar", someother_field="baz", {foo}=someother_field

this will create a kv like this bar="baz".

Hope this helps ...

cheers, MuS

mjlsnombrado
Communicator

Thanks 🙂 , but what I want is to set a field value to a variable, for example "fieldname" contains "A" and "B", I want to create a new field named "output" and it will contain "B" (output= B)

0 Karma

493669
Super Champion

@mjlsnombrado how does fieldname value is ? is it fieldname= "A B" or "A and B"

0 Karma

mjlsnombrado
Communicator

It is "A and B "

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...