Splunk Search

Is it possible to pass an eval value to table command?

raymondc
Engager

Hi,

I have a string with fields that I want to show in a table. (eval -> my_fields)

This is my search:

| makeresults 
| eval my_fields ="field_a field_b"
| eval field_a ="My Value A", field_b ="Other Value B" 
| table my_fields

And this is my search output:

my_fields
field_a field_b

But I want my result to be like this:

 field_a    | field_b
 My Value A | Other Value B

How can I do this?

0 Karma
1 Solution

somesoni2
Revered Legend

You can't pass a field value to a table command, but since your field names (in your sample search) are static, you can use subsearch like this to achieve the same.

| makeresults 
 | eval field_a ="My Value A", field_b ="Other Value B" 
 | table [|makeresults |  eval search ="field_a field_b" | table search ]

The 'search' is a special field name which will return the string value from the subsearch

View solution in original post

DalJeanis
Legend

You want to have one field that will determine which other fields will be displayed.

Two easy ways, the first describing @somesoni2's above...

your first search that gets values of fieldA and fieldB and potentially other fields
| table [ search your second search that returns names of fieldA and fieldB in a field named search as the only field ]

.. . or the alternate...

your second search that returns names of fieldA and fieldB in a field named foo (and we dont care how many other fields) 
| map search="search your first search that gets values of fieldA, field B and potentially other fields | table $foo$"
0 Karma

somesoni2
Revered Legend

You can't pass a field value to a table command, but since your field names (in your sample search) are static, you can use subsearch like this to achieve the same.

| makeresults 
 | eval field_a ="My Value A", field_b ="Other Value B" 
 | table [|makeresults |  eval search ="field_a field_b" | table search ]

The 'search' is a special field name which will return the string value from the subsearch

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...