Splunk Search

How to include an app name as a part of the search query?

nibinabr
Communicator

Is there a way by which I can get the app name as the part of the search query. Something like

index=myindex | eval my_app_name=$app_name$|

So if I'm executing the query above in the search and reporting app, my_app_name should be searched.

Thanks

Tags (4)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could do this:

  index=myindex | eval [rest /services/search/jobs splunk_server=local | addinfo | where sid = info_sid | rename eai:acl.app as my_app_name | return my_app_name]

View solution in original post

sloshburch
Splunk Employee
Splunk Employee

I just discovered that, starting with 6.5.0, there's some sweet new global tokens!

One of which is $env:app$

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Use_global_tokens_to_access_environment...

martin_mueller
SplunkTrust
SplunkTrust

You could do this:

  index=myindex | eval [rest /services/search/jobs splunk_server=local | addinfo | where sid = info_sid | rename eai:acl.app as my_app_name | return my_app_name]

Dawson014
Path Finder

Thanks! Just what I needed!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

No luck with relative URLs?

0 Karma

nibinabr
Communicator

I'm trying to build a dashboard that performs some operations on the URL en-US/app/app_name/ and I want this dashboard to work on all the apps without trying to change the app name.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'm with @alacercogitatus though, curious what you're trying to achieve here.

0 Karma

nibinabr
Communicator

Exactly what I was looking for.
Thanks

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

What are you trying to achieve here? Why would you want the app name in the search query?

0 Karma

rharrisssi
Path Finder

What are you trying to achieve with that question? It's passive aggressive and unhelpful.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...