Splunk Search

How to achieve dynamic field value filtering after main search?

amerineni
Loves-to-Learn

Hello,  I'm trying to filter my events/results after evalulating the field name and value dynamically using eval. 

 

index=XXXX  YYYYYYY  | eval field_name=PPPP | eval field_value=KKKK | search field_name=field_value

 

I tried  below options, but none worked.

index=XXXX   [|gentimes start=-1 | eval space="Test"| table space]

index=XXXX   [|gentimes start=-1 | eval space="Test"| fields space]

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

I am not entirely clear what it is you are trying to do - does this help?

index=XXXX  YYYYYYY  | where PPPP="KKKK"
0 Karma

amerineni
Loves-to-Learn

I need to evalute some search criteria based on the inputs selected and peform the search. 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please explain your usecase in a bit more detail

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...