Splunk Search

Reference multiple fields into a single name

irkey
Explorer

Is there a way to reference or combine multiple fields into a single name so that it can be referenced by that new name?

For example:   somefield IN (a,b,c,d)

If I  run  a query for "somefield" I get "a", "b", "c", "d" returned.

I want to be able to refer to "somefield" by a single name.  Is that possible?

So if run a query for "somefield", I would get the aggregate results of a,b,c,d ?

Labels (2)

gcusello
SplunkTrust
SplunkTrust

Hi @irkey ,

you have two choices:

use a macro, as hinted by @KendallW ,

use an eventtype containing the search parameters, for more infos see at https://docs.splunk.com/Documentation/Splunk/9.3.0/Knowledge/Abouteventtypes

in this way if you created an evenntype called e.g. "somefield" containing  somefield IN (a,b,c,d), you can call it using 

eventtype=somefield

Ciao.

Giuseppe

0 Karma

irkey
Explorer

Thank you, I will investigate this as well to see what works best.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @irkey ,

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

KendallW
Contributor
0 Karma

irkey
Explorer

Thank you, I will investigate this.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...