Splunk Search

How to pass string fields to search commands to use in parameters

neiljpeterson
Communicator

I am always looking for ways to DRY up my Splunk searches.

Here is a pattern I find myself repeating

index=<your base search here>
| eval field_combo=index."#".source."#".sourcetype."#".<something, something, dark side>
| timesearch <function> by field_combo
| <do some other stuff>
| makemv delim="#" field_combo
| table <some fields and other stuff>

We could DRY this up to be

index=<your base search here>
| delimer="#"
| eval field_combo=index.delimer.source.delimer.sourcetype.delimer.<something, something, dark side>
| timesearch <some function> by field_combo
| <do some other stuff>
| makemv delim=delimer field_combo
| table <some fields and other stuff>

But this line

| makemv delim=delimer field_combo

is not kosher. Splunk does not complain, but it does not work either.

I tried tostring() but same result.

This is an oversimplified example, but similar situations are common. I want to use eval'ed strings in search commands to make searches more maintainable. But how?

0 Karma

woodcock
Esteemed Legend

The only fully templatizable command in SPL is map (but you do have to be careful because it runs the entire inner search for every event in the outer search). Try this:

|noop|stats count| eval delimer="#"
| map search="|noop|stats count|eval index=\"index\"|eval source=\"src\"|eval sourcetype=\"st\"
| eval field_combo = index . $delimer$ . source . $delimer$ . sourcetype | makemv delim=\"$delimer$\" field_combo"
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...