Splunk Search

How to pass string fields to search commands to use in parameters

neiljpeterson
Communicator

I am always looking for ways to DRY up my Splunk searches.

Here is a pattern I find myself repeating

index=<your base search here>
| eval field_combo=index."#".source."#".sourcetype."#".<something, something, dark side>
| timesearch <function> by field_combo
| <do some other stuff>
| makemv delim="#" field_combo
| table <some fields and other stuff>

We could DRY this up to be

index=<your base search here>
| delimer="#"
| eval field_combo=index.delimer.source.delimer.sourcetype.delimer.<something, something, dark side>
| timesearch <some function> by field_combo
| <do some other stuff>
| makemv delim=delimer field_combo
| table <some fields and other stuff>

But this line

| makemv delim=delimer field_combo

is not kosher. Splunk does not complain, but it does not work either.

I tried tostring() but same result.

This is an oversimplified example, but similar situations are common. I want to use eval'ed strings in search commands to make searches more maintainable. But how?

0 Karma

woodcock
Esteemed Legend

The only fully templatizable command in SPL is map (but you do have to be careful because it runs the entire inner search for every event in the outer search). Try this:

|noop|stats count| eval delimer="#"
| map search="|noop|stats count|eval index=\"index\"|eval source=\"src\"|eval sourcetype=\"st\"
| eval field_combo = index . $delimer$ . source . $delimer$ . sourcetype | makemv delim=\"$delimer$\" field_combo"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...