Splunk Search
Highlighted

Pass a variable to fields command in a search - not working

Explorer

Hi,

I'm trying to build a mechanism to pre-define a set of fields in my searches. The mechanism normally uses a macro and a lookup table to create a list of fields and this part is working fine. The problem is that it seems the "fields" command can't use my list correctly. For instance:

index="main" 
| eval myfieldslist="host,sourcetype,source" 
| fields $myfieldslist$

That looks good to me but it only shows the _time field which means the "fields" command does consider the string "host,sourcetype,source" as a unique value and not as a list of values. I tried different things but I can't make it work.

Any help would be appreciated
Thank you

0 Karma
Highlighted

Re: Pass a variable to fields command in a search - not working

SplunkTrust
SplunkTrust

Try like this (the subsearch will get the string placed in fields command. The field name search is special field that returns the string value. You can replace the searchsearch with your current search/logic, just rename the field that contains field names to search)

index="main" 
| fields [| gentimes start=-1 | eval search="host,sourcetype,source" | table search]

View solution in original post

Highlighted

Re: Pass a variable to fields command in a search - not working

Explorer

Thank you so much, it is very helpful.

Actually I'm pretty close of what I wanted, I just don't understand why I only have 1 field in the "selectedfields" group (displayed as a column in the right search pane showing the events) and the others being in the "interestingfields" group and not displayed. However it seems I will be able to get them all displayed as expected by playing with a few more table/fields parameters

Thx again

0 Karma
Highlighted

Re: Pass a variable to fields command in a search - not working

Explorer

Another solution:

index="main"  
| fields [| makeresults | eval search="host,sourcetype,source" ]
0 Karma
Highlighted

Re: Pass a variable to fields command in a search - not working

Explorer

I'm trying to pass an eval field to this, but it doesn't work: is there something I'm missing?

| eval fieldNames="" | eval fieldNames=if(isnull(fieldA), fieldNames."fieldA,fieldB", fieldNames)
| fields - [| makeresults | eval search=fieldNames]
0 Karma
Highlighted

Re: Pass a variable to fields command in a search - not working

SplunkTrust
SplunkTrust

Put the fieldName in double quotes as you need to pass it as string.

[| makeresults | eval search="fieldNames"]
0 Karma
Highlighted

Re: Pass a variable to fields command in a search - not working

Explorer

It's a variable I'm defining earlier, not a string I want to pass. "fieldA,fieldB" is the string I want to pass.

0 Karma
Highlighted

Re: Pass a variable to fields command in a search - not working

SplunkTrust
SplunkTrust

You can't pass a field or value from main search to a subsearch, that'll not work.

0 Karma
Highlighted

Re: Pass a variable to fields command in a search - not working

Explorer

I wasn't aware this is the case; thanks for the help! If you have any suggestions without the subsearch, then that would be awesome, but if not, I still appreciate your help.

0 Karma
Highlighted

Re: Pass a variable to fields command in a search - not working

Legend

@haraksin if your use case is different you can post your question on Splunk Answers with the required details as to what you are trying to do and what is not working. Is this for a dashboard?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.