Splunk Search

Is it possible to save the value in a field in the first time it occurs and then assign it to later events?

Scott_Wang
Explorer

For example, if we have several events and there is a field named from, which is only existed in the first event. Is it possible to append this value to another event?

I'd like to save it as a temporary value and then use it later. I tried with eval temp=from, but I cannot use it(temp) in later events.

Thanks in advance!

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Scott_Wang,

if you're speaking of later use in the same search, you can use appenpipe command to add the result of a different search (in your case the same search but only the first value).

If instead later means in other searches, you can store the from value in a lookup or in a summary index (eventually with a schedule search) and recall it when you need.

Ciao.

Giuseppe

0 Karma

Scott_Wang
Explorer

Hi @gcusello,

Thanks for your reply. I'm in the first case you mentioned. But I do not know how to use appendpipe to achieve the goal.

Let's look at an example. 

| makeresults
| eval raw="xxx123,document1,orderRequest;document1,orderRequest"
| makemv delim=";" raw
| mvexpand raw
| rex field=raw "(?<id>\w+),doc"

Screen Shot 2020-07-28 at 11.55.02 PM.png

Currently, the id field in the second event is empty, and I'd like to fill it with xxx123, since it is also the document1 type. 

Could you write a query to achieve this one?

Thanks again!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Scott_Wang,

please try this:

| makeresults
| eval raw="xxx123,document1,orderRequest;document1,orderRequest"
| makemv delim=";" raw
| mvexpand raw
| rex field=raw "(?<id>\w+),doc"
| stats values(id) AS id values(raw) AS raw BY _time
| mvexpand raw

Ciao.

Giuseppe

Scott_Wang
Explorer

Hi @gcusello,

I'm sorry. In the real case, the timestamp is not equal. So I cannot use BY _time... Any other ideas?

 

What I'm trying to figure out is how to use xxx123 as a temporary value, and then whenever there is another document1 that occurs in new events, I can assign the value to the new events.

 

Thank you.😁

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...