Splunk Search

Is it possible to do eval and lookups with makeresult?

Thulasinathan_M
Contributor

Is it possible for me to do a main search and based on the results from main search I find the fileName and want to use it in the inputlookup for a sub-search. I'm using this on dashboard as well, so doing it by map is waiting for inputs in dashboard and never getting populated.

Lookup with map:

 

index=main Events
| stats count, Events
| eval fileName= <filename>
| eval lookup="| inputlookup ".fileName
| map search="| makeresults | map search="$lookup$

 


My Current search query:

 

index=main Events
| stats count, Events
| eval fileName= <filename>
[| inputlookup [| makeresults 
                  | eval search=fileName 
                  | table search]] | stats count as known by Events
| fillnull known values=0
<remaining search>​

 

 

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As I have told you before, fields from the outer search are not available to the subsearch because the subsearch is executed first.

Having said that, since you are using a dashboard, you may be able to use a base search, and set a token in the done handler of the base search, which you can then use in the panel search

Thulasinathan_M
Contributor

Hi @ITWhisperer , Thanks. Used Tokens and it done the trick.
I try to push these results to a summary index, and will keep on doing this only if the event is not already present in summary index but I want to maintain the count of this events as well. It seems impossible to maintain unique event in summary index and keep on updating the count of events. Could you kindly suggest a solution for this please.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You should check out my talk on Summary index idempotency

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...