Solved: Re: How to search all the events consisting of a w...

piece · ‎05-15-2023

Consider I have 8 events.
1. txn started for fruit.mango
2. money paid for fruit.mango
3. received fruit.mango
4. txn completed for fruit.mango
5. cust wants to buy apple
6. getting money for apple
7. sending apple to cust
8. txn started for veegtable.carrot

I get a variable 'name' from my dashboard. This name is actually a string consisting of space separated words or just a single word. For ex. it could be either 'apple' or 'txn started for fruit.mango'. What I want to do is first I want to extract the name of article then search the whole event space with that article name and then do further processing.

Ex. If I get $name$= 'txn started for fruit.mango'. I want to extract mango and then run the query such that I get all the events which have the word mango in it. After that i create a table of the steps the transaction took. I use

index=.. $name | if(match($name, "\s"), mvindex(split($name, "."), 1), $name)

to extract the name but then I get only a single event matching that is `txn started for fruit.mango`, other events which also has 'mango' in it like 'received fruit.mango' doesnt match.

How do I go about it? Any help will be much appreciated, thanks.

ITWhisperer · ‎05-15-2023

<form version="1.1">
  <label>Text parsing</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="name">
      <label>Select name</label>
      <choice value="txn started for fruit.mango">txn started for fruit.mango</choice>
      <change>
        <eval token="app">mvindex(split($name$,"."),1)</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>app is $app$</html>
    </panel>
  </row>
</form>

View solution in original post

piece · ‎05-15-2023

@ITWhisperer Oh, in that case could you please help me to figure out how to use <eval> before <search> tag in xml.

ITWhisperer · ‎05-15-2023

Where is this "variable" coming from?

If it is from a SimpleXML input, you could include some change processing on the input to create a token which has split "mango" from the rest of the input token value, and use that token instead.

piece · ‎05-15-2023

@ITWhisperer I can not make changes to the input variable 'name' as a lot of other things depend on it.

ITWhisperer · ‎05-15-2023

I am not saying to change 'name', I said to create a token (based on the contents of 'name')

piece · ‎05-15-2023

@ITWhisperer Oh, in that case could you please help me determine how do I use <eval> tag to extract the value before the <search><query>My splunk query</query></search>

ITWhisperer · ‎05-15-2023

<form version="1.1">
  <label>Text parsing</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="name">
      <label>Select name</label>
      <choice value="txn started for fruit.mango">txn started for fruit.mango</choice>
      <change>
        <eval token="app">mvindex(split($name$,"."),1)</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <html>app is $app$</html>
    </panel>
  </row>
</form>

How to search all the events consisting of a word that I get from a variable?

eval

subsearch

Can’t make it to .conf25? Join us online!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Unlock What’s Next: The Splunk Cloud Platform at .conf25

Are you a member of the Splunk Community?