Splunk Search

How to reference a tagged field from an eval command?

gilescope
Explorer

We've tagged our hosts which we can search for by 'tag::host', but how do we reference that field from an eval command? Do we first need to rename it or is there a direct way?

Tags (2)
1 Solution

MuS
Legend

Hi gilescope,

this is possible. I used a tag called foo-box for a special host and if you search like this

your base search here | where 'tag::host'="foo-box"

you can use it without any problem.

cheers, MuS

View solution in original post

MuS
Legend

Hi gilescope,

this is possible. I used a tag called foo-box for a special host and if you search like this

your base search here | where 'tag::host'="foo-box"

you can use it without any problem.

cheers, MuS

gilescope
Explorer

ah yes. single quotes is perfect. I tried double quotes but that turns out as a string constant.

MuS
Legend

well where is an eval command .... can you provide an example of yours which does not work?

0 Karma

gilescope
Explorer

Yes this works for search, but I want to include the tag::host field in an eval expression.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...