Splunk Search

How to include an app name as a part of the search query?

nibinabr
Communicator

Is there a way by which I can get the app name as the part of the search query. Something like

index=myindex | eval my_app_name=$app_name$|

So if I'm executing the query above in the search and reporting app, my_app_name should be searched.

Thanks

Tags (4)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could do this:

  index=myindex | eval [rest /services/search/jobs splunk_server=local | addinfo | where sid = info_sid | rename eai:acl.app as my_app_name | return my_app_name]

View solution in original post

sloshburch
Splunk Employee
Splunk Employee

I just discovered that, starting with 6.5.0, there's some sweet new global tokens!

One of which is $env:app$

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Use_global_tokens_to_access_environment...

martin_mueller
SplunkTrust
SplunkTrust

You could do this:

  index=myindex | eval [rest /services/search/jobs splunk_server=local | addinfo | where sid = info_sid | rename eai:acl.app as my_app_name | return my_app_name]

Dawson014
Path Finder

Thanks! Just what I needed!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

No luck with relative URLs?

0 Karma

nibinabr
Communicator

I'm trying to build a dashboard that performs some operations on the URL en-US/app/app_name/ and I want this dashboard to work on all the apps without trying to change the app name.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'm with @alacercogitatus though, curious what you're trying to achieve here.

0 Karma

nibinabr
Communicator

Exactly what I was looking for.
Thanks

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

What are you trying to achieve here? Why would you want the app name in the search query?

0 Karma

rharrisssi
Path Finder

What are you trying to achieve with that question? It's passive aggressive and unhelpful.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...