Splunk Search

How can I give source string dynamically in COLLECT command?

tac24
New Member

I want to extract a value dynamically in a subsearch and give the value (string) to source= << string>> of COLLECT command. The following example is extracting YYYYMMDD from the source field and making "src_yyyymmdd" string that will be given to source=<< string>> of the COLLECT command.

    main search... | collect index="ABC" source=[search index="XYZ" 
        |head 1 | rex field=source "^FILENAME_(?<YYYYMMDD>\d{8})_.*"
        | eval fieldval="\""+"src_"+YYYYMMDD+"\""  
        | table source YYYYMMDD fieldval
        | return $fieldval]

When I checked the above subsearch as a main search, every field value after table command was what I expected.

alt text

Unfortunately, the result was Error in 'collect' command: Invalid argument: 'src_20180705'

Could someone tell me why this happens and how to solve this problem?

Thanks.

0 Karma

niketn
Legend

@tac24 can you not override the source field even before the collect command with the value you need?

| eval source= [<yourQueryToGetNewSource>]
| collect <yourCommandArguments>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

poete
Builder

Hello @tac24,

the documentation states : Syntax: source= (from http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Collect).

It seems that you have the same problem as this one : https://answers.splunk.com/answers/240798/how-to-return-a-single-value-from-a-subsearch-into.html

So, this should do :

main search... | collect index="ABC" source=[search index="XYZ" 
         |head 1 | rex field=source "^FILENAME_(?<YYYYMMDD>\d{8})_.*"
         | eval val="src_".YYYYMMDD
         | eval fieldval="\"".val."\""
         | table source YYYYMMDD fieldval
         | return $fieldval]
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...