Splunk Search

How can I select the index to search dynamically?

sillingworth
Path Finder

I want to say

| eval my_index=(something, probably using if)
| append [index=(whatever my_index is)]

How can I do this? How can I set index= to a field, rather that just a string?

Further question: Can I make that append completely optional, so if a certain condition isn't met it won't run the subsearch at all (my workaround was going to be setting my_index to something that will never match a real index name)?

Tags (1)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

This version replaces the incoming records with the results of the search

| eval my_index=case(myfield="foo","bar",myfield="fizz","buzz",true(),"AintGotNoIndexByThisName")
| map search="search index=$my_index$ some other search terms and pipes here | table index myfield3 myfield7"

This version does a search once for each value of index and appends it to the current result set...

| eval my_index=case(myfield="foo","bar",myfield="fizz","buzz",true(),"AintGotNoIndexByThisName")
| appendpipe 
    [ | table index 
      | dedup index
      | map search="search index=$my_index$ some other search terms and pipes here | table index myfield3 myfield7"
    ]

As a general case, the only thing that I've found that allows any usage of field values to replace search terms is map. Which is slow and clumsy and should be avoided if possible.

0 Karma

sillingworth
Path Finder

Ah, I didn't know you could use $something$ for things other that tokens. Thanks!

Is there a reason you couldn't just do:

| eval my_index=(something, probably using if)
| append index=$my_index$ .....

? I appreciate yours makes it easy to have several indexes.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...