Splunk Search

How to invoke SPL from a field?

schose
Builder

Hi all,

I' searching for a possibility to invoke SPL from a field. Background: I want to dynamically display tables columns. I am getting the correct format from a lookup where the field "spl" contains the output like "table host source sourcetype"

index=summary | lookup formatting.csv matchhost as host | invoke(spl)

Is there a possibility to execute spl coming from a field?

Thanks for your help in advance,

Andreas

Tags (4)
0 Karma
1 Solution

goelli
Communicator

I think you want to sort the order of the fields in a table based on which savedsearch the events are from. For this you need to search for a specific saved_search. Then you have a lookup with a 1:1 connection between savedsearch and format. If this is true, try the following:

index=summary search_name="your_saved_search"
| table
[ | inputlookup formatting.csv
| search search_name="your_saved_search"
| fields format
| rename format as search ]

Background for this is, that a field named "search" from a subsearch is interpreted as SPL in the base search.

View solution in original post

goelli
Communicator

I think you want to sort the order of the fields in a table based on which savedsearch the events are from. For this you need to search for a specific saved_search. Then you have a lookup with a 1:1 connection between savedsearch and format. If this is true, try the following:

index=summary search_name="your_saved_search"
| table
[ | inputlookup formatting.csv
| search search_name="your_saved_search"
| fields format
| rename format as search ]

Background for this is, that a field named "search" from a subsearch is interpreted as SPL in the base search.

schose
Builder

Hi,

Well, I'd like to create a certain dashboard: maybe I need to tell more about the background: I want to store the result of an alert for later viewing. All alerts table out their results out in a different way. First idea is to use summary indexes for storing the results.
Unfurtunatly in the summary index the table columns are reordered alphabetically.

For later viewing I want to create a dashboard which calls the Summaryindex and table out the result. As the resulttable is dynamically i like to interpret spl which is coming from the lookup.

If this is not possible - i guess i've seen it somewhere in the past - im may have to create a custom alert action, but i want to use less custom code as possible.

Regards,

Andreas

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

It sounds like you are building a dashboard, so you want to link from a field to a drilldown search.

This is a standard feature.

Here's how to link to a search:

https://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/DrilldownLinkToSearch

here's how to link to a separate dashboard:

https://docs.splunk.com/Documentation/Splunk/7.0.2/Viz/DrilldownLinkToDashboard

0 Karma
Get Updates on the Splunk Community!

Set Up More Secure Configurations in Splunk Enterprise With Config Assist

This blog post is part 3 of 4 of a series on Splunk Assist. Click the links below to see the other ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...