Splunk Search

Is it possible to save the value in a field in the first time it occurs and then assign it to later events?

Scott_Wang
Explorer

For example, if we have several events and there is a field named from, which is only existed in the first event. Is it possible to append this value to another event?

I'd like to save it as a temporary value and then use it later. I tried with eval temp=from, but I cannot use it(temp) in later events.

Thanks in advance!

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Scott_Wang,

if you're speaking of later use in the same search, you can use appenpipe command to add the result of a different search (in your case the same search but only the first value).

If instead later means in other searches, you can store the from value in a lookup or in a summary index (eventually with a schedule search) and recall it when you need.

Ciao.

Giuseppe

0 Karma

Scott_Wang
Explorer

Hi @gcusello,

Thanks for your reply. I'm in the first case you mentioned. But I do not know how to use appendpipe to achieve the goal.

Let's look at an example. 

| makeresults
| eval raw="xxx123,document1,orderRequest;document1,orderRequest"
| makemv delim=";" raw
| mvexpand raw
| rex field=raw "(?<id>\w+),doc"

Screen Shot 2020-07-28 at 11.55.02 PM.png

Currently, the id field in the second event is empty, and I'd like to fill it with xxx123, since it is also the document1 type. 

Could you write a query to achieve this one?

Thanks again!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Scott_Wang,

please try this:

| makeresults
| eval raw="xxx123,document1,orderRequest;document1,orderRequest"
| makemv delim=";" raw
| mvexpand raw
| rex field=raw "(?<id>\w+),doc"
| stats values(id) AS id values(raw) AS raw BY _time
| mvexpand raw

Ciao.

Giuseppe

Scott_Wang
Explorer

Hi @gcusello,

I'm sorry. In the real case, the timestamp is not equal. So I cannot use BY _time... Any other ideas?

 

What I'm trying to figure out is how to use xxx123 as a temporary value, and then whenever there is another document1 that occurs in new events, I can assign the value to the new events.

 

Thank you.😁

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...