Splunk Search

How to extract a field name as a value?

ssiat479
Engager

My apologies if there is an obvious answer to this question, but I have been searching Splunk answers and the documentation without success.

I am interested in passing a field's name as a value to manipulate with eval in later steps. For example:
FIELD1=value1
lastname=smith

I want the ability to potentially create a new string field via eval with containing both the field name and value of FIELD1. For example:
NEWFIELD="FIELD1 - value1"
details="lastname - smith"

However, I cannot find a way to print the field name of FIELD1 in an eval. I appreciate any help! Thanks.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | foreach lastname [ eval details = "<<FIELD>> - " . <<FIELD>> ]

View solution in original post

woodcock
Esteemed Legend

Like this:

... | foreach lastname [ eval details = "<<FIELD>> - " . <<FIELD>> ]
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...