Splunk Search

Search using variables

lakromani
Builder

This should be trivial to do, but I am not able to search using variables.

Eks this works
some splunk data | search direction="out"

But this does not:
some splunk data | eval test="out" | search direction="$test$"
nor this:
some splunk data | eval test="out" | search direction=$test$

What do I do wrong. Search google, but did not find and working solution.

0 Karma
1 Solution

somesoni2
Revered Legend

What is the requirement here? From where this variable should come from? If it's a field from same search, you can use like this

some splunk data | eval test="out" | where direction=test

View solution in original post

somesoni2
Revered Legend

What is the requirement here? From where this variable should come from? If it's a field from same search, you can use like this

some splunk data | eval test="out" | where direction=test

lakromani
Builder

That did do it. Data is coming from a drop down input on a dashboard.
If you post it as an answer I can accept it 🙂

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...