Splunk Search

How to achieve dynamic field value filtering after main search?

amerineni
Loves-to-Learn

Hello,  I'm trying to filter my events/results after evalulating the field name and value dynamically using eval. 

 

index=XXXX  YYYYYYY  | eval field_name=PPPP | eval field_value=KKKK | search field_name=field_value

 

I tried  below options, but none worked.

index=XXXX   [|gentimes start=-1 | eval space="Test"| table space]

index=XXXX   [|gentimes start=-1 | eval space="Test"| fields space]

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not entirely clear what it is you are trying to do - does this help?

index=XXXX  YYYYYYY  | where PPPP="KKKK"
0 Karma

amerineni
Loves-to-Learn

I need to evalute some search criteria based on the inputs selected and peform the search. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please explain your usecase in a bit more detail

0 Karma
Get Updates on the Splunk Community!

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...