Reference multiple fields into a single name

[irkey]

Is there a way to reference or combine multiple fields into a single name so that it can be referenced by that new name?

For example:   somefield IN (a,b,c,d)

If I  run  a query for "somefield" I get "a", "b", "c", "d" returned.

I want to be able to refer to "somefield" by a single name.  Is that possible?

So if run a query for "somefield", I would get the aggregate results of a,b,c,d ?

[gcusello]

Hi @irkey ,

you have two choices:

use a macro, as hinted by @KendallW ,

use an eventtype containing the search parameters, for more infos see at https://docs.splunk.com/Documentation/Splunk/9.3.0/Knowledge/Abouteventtypes

in this way if you created an evenntype called e.g. "somefield" containing  somefield IN (a,b,c,d), you can call it using 

eventtype=somefield

Ciao.

Giuseppe

[irkey]

Thank you, I will investigate this as well to see what works best.

[gcusello]

Hi @irkey ,

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[KendallW]

@irkey Put them in a search macro - https://docs.splunk.com/Documentation/SplunkCloud/latest/Knowledge/Usesearchmacros 

[irkey]

Thank you, I will investigate this.