Inline Variable Definitions and Expansions With Eval

[niall_munnelly]

Hiya,

I swear I knew how to do this without macros, which seem like overkill, but I've lost it. Here's a simple example - define a field and expand that, so my search uses the value of that field:

eval hostname=server1| search host=%{hostname}

I've tried the usual shell and python syntax for variables as well as Splunk's token syntax , search host=$hostname$, but I'm getting zero results across the board, because it;s searching for the literal string. What do I need to do to expand that "hostname" variable/field? Thanks.

[martin_mueller]

Another guess, are you looking for this?

... | eval hostname = "server1" | where host=hostname

[lguinn2]

Are you thinking of the foreach command?

Doc page: foreach

There is also map, but that seems a bit far off the mark: map