Splunk Search

Is it possible to do eval and lookups with makeresult?

Thulasinathan_M
Contributor

Is it possible for me to do a main search and based on the results from main search I find the fileName and want to use it in the inputlookup for a sub-search. I'm using this on dashboard as well, so doing it by map is waiting for inputs in dashboard and never getting populated.

Lookup with map:

 

index=main Events
| stats count, Events
| eval fileName= <filename>
| eval lookup="| inputlookup ".fileName
| map search="| makeresults | map search="$lookup$

 


My Current search query:

 

index=main Events
| stats count, Events
| eval fileName= <filename>
[| inputlookup [| makeresults 
                  | eval search=fileName 
                  | table search]] | stats count as known by Events
| fillnull known values=0
<remaining search>​

 

 

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As I have told you before, fields from the outer search are not available to the subsearch because the subsearch is executed first.

Having said that, since you are using a dashboard, you may be able to use a base search, and set a token in the done handler of the base search, which you can then use in the panel search

Thulasinathan_M
Contributor

Hi @ITWhisperer , Thanks. Used Tokens and it done the trick.
I try to push these results to a summary index, and will keep on doing this only if the event is not already present in summary index but I want to maintain the count of this events as well. It seems impossible to maintain unique event in summary index and keep on updating the count of events. Could you kindly suggest a solution for this please.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You should check out my talk on Summary index idempotency

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...