Splunk Search

How to filter the results based on the evaluated field?

amerineni
Loves-to-Learn

I'm trying the below query,

index=XXXXXXXXX   | eval space="cf_space_name=production" | search "space"  YYYYYYYYYYYY | stats count

===================================================================

I want to filter the results based on the evaluated field.

| search "space"    XXXXXXXXXXXXX    => is not returning correct values

|  search "cf_space_name=production"    XXXXXXXXXXXXX    =>  but If I use the value like this its working.

how to fix this? Thanks for the help.

 

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Like @richgalloway mentioned, the value in 'space' is not substituted as part of command in | search.  Can you explain why it is even necessary to use that syntax if  | search "cf_space_name=production" YYYYYYYYYYY already works?  Maybe you are thinking of a token in dashboard?

(As a side, | search "cf_space_name=production" YYYYYYYYYYY  is semantically different from | search cf_space_name=production YYYYYYYYYYY.  You want to consider what exactly is intended.)

0 Karma

amerineni
Loves-to-Learn

I have two inputs in the dashboard and I need to evaluate filed name and value to compare dynamically based on those inputs and filter events based on that.  That is what I'm tryign to do.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

I still don't see how "cf_space_name=production" is a dynamic input.  In this form, it is just a static string.  Can you explain?  Maybe you can illustrate with data (anonymize as necessary)?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I hoping this was in a dashboard.  If you have an input called "space" that holds a cf_space_name value then you can reference that token in the SPL.

index=XXXXXXXXX cf_space_name=$space$ YYYYYYYYYYYY 
| stats count
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The search command treats "space" with or without quotation marks as a literal string rather than a field name. 

The eval command assigns a value to a field, creating the field if necessary.  It does not define variables that can be used in arbitrary places.

To search for specific text in an event, put that text in a search command.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...