Splunk Search

How to assign value of one field to a variable?

ppanchal
Path Finder

I have data in my log which looks like,

extraData:  {   [-] 
         MD_independent_new:     2016-11-30T04:35:57Z   
         MD_sitedependent_new:   2016-11-30T17:31:22Z   
         app_version_build_id:   20161109   
         db_version:     27 
         device_id:  A000003088E203 
         driver_id:  090201 
         login_environment:  Production 
         site_id:    S04160 : Irvine Hauling    
         vehicle_id:     104681 
    }   

To extract fields from this log, I have my search like,

index=mint | table extraData.site_id

Is there a way I can assign the value of extraData.site_id to another variable?

My below search string fails,

index=mint |eval temp=extraData.site_id| table temp

Please assist.

0 Karma

gokadroid
Motivator

Please see the documentation examples here on how to use output to save the value in the variable:

http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Spath#1._Specify_output_and_path_f...

Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...