Hi all,
I' searching for a possibility to invoke SPL from a field. Background: I want to dynamically display tables columns. I am getting the correct format from a lookup where the field "spl" contains the output like "table host source sourcetype"
index=summary | lookup formatting.csv matchhost as host | invoke(spl)
Is there a possibility to execute spl coming from a field?
Thanks for your help in advance,
Andreas
I think you want to sort the order of the fields in a table based on which savedsearch the events are from. For this you need to search for a specific saved_search. Then you have a lookup with a 1:1 connection between savedsearch and format. If this is true, try the following:
index=summary search_name="your_saved_search"
| table
[ | inputlookup formatting.csv
| search search_name="your_saved_search"
| fields format
| rename format as search ]
Background for this is, that a field named "search" from a subsearch is interpreted as SPL in the base search.
I think you want to sort the order of the fields in a table based on which savedsearch the events are from. For this you need to search for a specific saved_search. Then you have a lookup with a 1:1 connection between savedsearch and format. If this is true, try the following:
index=summary search_name="your_saved_search"
| table
[ | inputlookup formatting.csv
| search search_name="your_saved_search"
| fields format
| rename format as search ]
Background for this is, that a field named "search" from a subsearch is interpreted as SPL in the base search.
Hi,
Well, I'd like to create a certain dashboard: maybe I need to tell more about the background: I want to store the result of an alert for later viewing. All alerts table out their results out in a different way. First idea is to use summary indexes for storing the results.
Unfurtunatly in the summary index the table columns are reordered alphabetically.
For later viewing I want to create a dashboard which calls the Summaryindex and table out the result. As the resulttable is dynamically i like to interpret spl which is coming from the lookup.
If this is not possible - i guess i've seen it somewhere in the past - im may have to create a custom alert action, but i want to use less custom code as possible.
Regards,
Andreas
It sounds like you are building a dashboard, so you want to link from a field to a drilldown search.
This is a standard feature.
Here's how to link to a search:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/DrilldownLinkToSearch
here's how to link to a separate dashboard:
https://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/DrilldownLinkToDashboard