Splunk Search

Should I be using eval or subsearch? Not able to perform Search when evaluating a boolean expression

NateStreet
New Member

I know this is a Splunk newbie question but I am having some issues getting this to work. I have a column field named "Account_Name" from a sourcetype="AD", for instance. I am creating a form where there are several empty text fields (Account Name, IP Address, Host Name, etc). I may have all of the fields or I may have just one piece of information pertaining to a particular event.

Based on which field contains a value (e.g. length of character string is greater than 0), I'd like to assign the character string a default value to search. So if I have a variable named $test_account_name$, I'd like to be able to run something like this:

eval XYZ=if($test_account_name$!=0, $test_account_name$,"*")

Here is where things go beyond my realm of Splunk understanding. At this point, the new variable XYZ should be assigned a value of $test_account_name$ OR contain a wildcard ("*"). Now, I want to be able to pass the contents of XYZ back to the original variable "Account_Name" in order to search the sourcetype with the results contained in XYZ.

I am sure there is a more appropriate function to perform this but I figured I would ask! Thanks in advance!

Tags (2)
0 Karma

NOUMSSI
Builder

Hi,
Try this:

...|eval XYZ=if("$test_account_name$"!=0, "$test_account_name$","*")|...|join [search sourcetype="AD" ...|eval Account_Name=XYZ|...]
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!