How to store this string in a variable and use it in any other index?

[nikhilmalkari18]

index = "abc" required_field = "xx" | table date - gives me a single string in the table. How can I store this string in a variable and use it in any other index.

Thank you 

[PickleRick]

What do you mean by "using it in another index"?

SPL is not a procedural language and in general doesn't have the concept of "variables" as external storage to hold state between different searches.

There are some techniques which can be used to store something resembling a state - KV-store, collecting to summary index. But this is pretty advanced stuff (from the conceptual point of view - technically it's relatively easy) and I very much doubt that's what you need.

If you want to search for values from another search, you might use subsearch but also often can rephrase your problem to do the search in a completely different way.

[VatsalJagani]

@nikhilmalkari18 

IF you want to add a new field into data/events found in index=abc, then

index=abc | eval required_field = "xx"

If there are no events already, and for testing, if you want to generate a new event, then

| makeresults | eval required_field = "xx"

I hope this helps!!!

[nikhilmalkari18]

I do not want to add a new field to the index. I want to know how to store a string coming from a search command in a variable.

[VatsalJagani]

@nikhilmalkari18 - That's what eval command does. But this does not store variables/fields permanently. Its scope is limited to that particular search only.

If you want to do it for all searches implicitly, then you can use EVAL in the props.conf file. -> Calculated Fields - https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/definecalcfields 

If you want to do it permanently you can do it by extracting the field at index time - https://docs.splunk.com/Documentation/Splunk/8.2.6/Data/Configureindex-timefieldextraction 

I hope this helps!!!