Splunk Search

How can I assign a field value to a variable using eval?

Communicator

I want to assign a specific field value to a variable I want to do something like this:

|eval output = ('Fieldname'=fieldvalue)
Tags (3)
0 Karma

Splunk Employee
Splunk Employee
0 Karma

Super Champion

Try this:

...| eval splitted=split(Field, "and")|eval output =mvindex(splitted,1)

Try this run anywhere search:

|makeresults|eval Field="A and  B"| eval splitted=split(Field, "and")|eval output =mvindex(splitted,1)
0 Karma

SplunkTrust
SplunkTrust

Hi mjlsnombrado,

If I understand your question correct, you can do this:

.... | eval output=fieldname

But if you actually want to use a value of a field as new field name, you can do this:

.... | eval foo="bar", someother_field="baz", {foo}=someother_field

this will create a kv like this bar="baz".

Hope this helps ...

cheers, MuS

Communicator

Thanks 🙂 , but what I want is to set a field value to a variable, for example "fieldname" contains "A" and "B", I want to create a new field named "output" and it will contain "B" (output= B)

0 Karma

Super Champion

@mjlsnombrado how does fieldname value is ? is it fieldname= "A B" or "A and B"

0 Karma

Communicator

It is "A and B "

0 Karma