Splunk Search

How to pass string fields to search commands to use in parameters


I am always looking for ways to DRY up my Splunk searches.

Here is a pattern I find myself repeating

index=<your base search here>
| eval field_combo=index."#".source."#".sourcetype."#".<something, something, dark side>
| timesearch <function> by field_combo
| <do some other stuff>
| makemv delim="#" field_combo
| table <some fields and other stuff>

We could DRY this up to be

index=<your base search here>
| delimer="#"
| eval field_combo=index.delimer.source.delimer.sourcetype.delimer.<something, something, dark side>
| timesearch <some function> by field_combo
| <do some other stuff>
| makemv delim=delimer field_combo
| table <some fields and other stuff>

But this line

| makemv delim=delimer field_combo

is not kosher. Splunk does not complain, but it does not work either.

I tried tostring() but same result.

This is an oversimplified example, but similar situations are common. I want to use eval'ed strings in search commands to make searches more maintainable. But how?

0 Karma

Esteemed Legend

The only fully templatizable command in SPL is map (but you do have to be careful because it runs the entire inner search for every event in the outer search). Try this:

|noop|stats count| eval delimer="#"
| map search="|noop|stats count|eval index=\"index\"|eval source=\"src\"|eval sourcetype=\"st\"
| eval field_combo = index . $delimer$ . source . $delimer$ . sourcetype | makemv delim=\"$delimer$\" field_combo"
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...