Splunk Search

How to assign value of one field to a variable?

ppanchal
Path Finder

I have data in my log which looks like,

extraData:  {   [-] 
         MD_independent_new:     2016-11-30T04:35:57Z   
         MD_sitedependent_new:   2016-11-30T17:31:22Z   
         app_version_build_id:   20161109   
         db_version:     27 
         device_id:  A000003088E203 
         driver_id:  090201 
         login_environment:  Production 
         site_id:    S04160 : Irvine Hauling    
         vehicle_id:     104681 
    }   

To extract fields from this log, I have my search like,

index=mint | table extraData.site_id

Is there a way I can assign the value of extraData.site_id to another variable?

My below search string fails,

index=mint |eval temp=extraData.site_id| table temp

Please assist.

0 Karma

gokadroid
Motivator

Please see the documentation examples here on how to use output to save the value in the variable:

http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Spath#1._Specify_output_and_path_f...

Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...