Splunk Search

Splunk help

borisk95
New Member

I want to |search sourcetype=syslog | eval DATA=[search tratata | eval ip=somedata | return $ip] | search DATA
Example of ip ( 127.0.0.1 , (answer=127.0.0.1))
I get an error The number 127.0.0.1 is not valid.
Trying to use | eval ip=tostring(ip) | return $ip do not help

Tags (2)
0 Karma

borisk95
New Member

The reason is to search some value, eval this as a value or combined multivalie and search eval field=1 as | search 1

0 Karma

DavidHourani
Super Champion

Hi @borisk95,

You can run the following search for the same results if you're trying to filter on the DATA field :

 |search sourcetype=syslog [search tratata | eval ip=somedata|rename ip AS DATA | return $DATA] 

Cheers,
David

0 Karma

richgalloway
SplunkTrust
SplunkTrust

First run the subsearch by itself to verify you get the expected results.

search tratata | eval ip=somedata | return $ip

You may have better luck with

search tratata | eval ip=somedata | fields ip | format

Modify the search as needed to get the desired output. Once you have the output as you like it, put the query together.

sourcetype=syslog | eval DATA=[search tratata | eval ip=somedata | fields ip | format] | search DATA

Or perhaps

sourcetype=syslog [search tratata | eval ip=somedata | fields ip | format] 
---
If this reply helps you, an upvote would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please describe the problem you are trying to solve. There may be a better way to do it.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

borisk95
New Member

I'm trying to eval value from subsearch
ex searching specific data collecting them to multivalue field and pass to variable than search.
Do splunk have variables something like global variables

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!