How to include an app name as a part of the search query?

[nibinabr]

Is there a way by which I can get the app name as the part of the search query. Something like

index=myindex | eval my_app_name=$app_name$|

So if I'm executing the query above in the search and reporting app, my_app_name should be searched.

Thanks

[sloshburch]

I just discovered that, starting with 6.5.0, there's some sweet new global tokens!

One of which is $env:app$

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Use_global_tokens_to_access_environment...

[martin_mueller · Accepted solution]

You could do this:

  index=myindex | eval [rest /services/search/jobs splunk_server=local | addinfo | where sid = info_sid | rename eai:acl.app as my_app_name | return my_app_name]

[Dawson014]

Thanks! Just what I needed!

[martin_mueller]

No luck with relative URLs?

[nibinabr]

I'm trying to build a dashboard that performs some operations on the URL en-US/app/app_name/ and I want this dashboard to work on all the apps without trying to change the app name.

[martin_mueller]

I'm with @alacercogitatus though, curious what you're trying to achieve here.

[nibinabr]

Exactly what I was looking for.
Thanks

[alacercogitatus]

What are you trying to achieve here? Why would you want the app name in the search query?

[rharrisssi]

What are you trying to achieve with that question? It's passive aggressive and unhelpful.