Splunk Search

Search using variables

lakromani
Builder

This should be trivial to do, but I am not able to search using variables.

Eks this works
some splunk data | search direction="out"

But this does not:
some splunk data | eval test="out" | search direction="$test$"
nor this:
some splunk data | eval test="out" | search direction=$test$

What do I do wrong. Search google, but did not find and working solution.

0 Karma
1 Solution

somesoni2
Revered Legend

What is the requirement here? From where this variable should come from? If it's a field from same search, you can use like this

some splunk data | eval test="out" | where direction=test

View solution in original post

somesoni2
Revered Legend

What is the requirement here? From where this variable should come from? If it's a field from same search, you can use like this

some splunk data | eval test="out" | where direction=test

lakromani
Builder

That did do it. Data is coming from a drop down input on a dashboard.
If you post it as an answer I can accept it 🙂

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...