Splunk Search

How to use foreach with search filter?

Hi All,

I have a requirement to use foreach with search filter.

Example fileds 192345_Employeestatus,207754_Employeestatus,158345_Employeestatus


| foreach *_Employeestatus [search <<MATCHSTR>>_Employeestatus='<<FIELD>>'
(('<<FIELD>>'="") OR ('<<FIELD>>'="new") OR ('<<FIELD>>'="Working") OR ('<<FIELD>>'="exit")
OR ('<<FIELD>>'="IND") OR ('<<FIELD>>'="Aus") OR ('<<FIELD>>'="relocated") OR ('<<FIELD>>'="yettojoin")
OR ('<<FIELD>>'="Manager") OR ('<<FIELD>>'="AsstManager") OR ('<<FIELD>>'="SeniorAss")) ]


But search filter is not filtering the data as expected.
Need your help ..
Thanks in advance..

Learner ...

Labels (2)
0 Karma

Ultra Champion

| foreach *_Employeestatus [ eval Employeestatus=mvappend(Employeestatus,'<<FIELD>>')]
| streamstats count as session
| mvexpand Employeestatus
| search Employeestatus="" OR Employeestatus="new" OR ....
| stats values(*) as * by session
| fields - Emplyeestatus session

foreach can't use by search filter, I guess.

0 Karma


What problem are you trying to solve?  Where did the requirement to use foreach come from?

Make sure the subsearch makes sense once the variables are substituted.  For example:

search 192345_Employeestatus='192345_Employeestatus'
(('192345_Employeestatus'="") OR ('192345_Employeestatus'="new") OR ('192345_Employeestatus'="Working") OR ('192345_Employeestatus'="exit")
OR ('192345_Employeestatus'="IND") OR ('192345_Employeestatus'="Aus") OR ('192345_Employeestatus'="relocated") OR ('192345_Employeestatus'="yettojoin")
OR ('192345_Employeestatus'="Manager") OR ('192345_Employeestatus'="AsstManager") OR ('192345_Employeestatus'="SeniorAss"))
If this reply helps you, an upvote would be appreciated.
0 Karma


Thanks for your reply.

Now i have 3 field with prefix values of 192345_Employeestatus,207754_Employeestatus,158345_Employeestatus.
In future we will get some more fileds with XXXXXX_Employeestatus. We dont know wht will be that prefix numbers.
So now while writing query itself. We are looking for the solution to get the fields(192345_Employeestatus,207754_Employeestatus,158345_Employeestatus,XXXXXX_Employeestatus etc) in for loop and check them in search filter.

Im trying to use search filter with same values with different fields in foreach loop.


0 Karma

I'm still wondering if foreach is the right solution to the problem, but don't know what the problem is so can't determine if there's a better answer.
If this reply helps you, an upvote would be appreciated.
0 Karma