Splunk Search

Table fields as variable

amiragha
New Member

Is there anyway to pass a variable to the table command? Basically, I have field1, field2 and field3 from my search. I cannot get this to work

eval myfields="field1,field2,field3)
| table myfields

Tried | Table $myfields$ too

Just trying to get | table field1 field2 field3

Thanks for any help

0 Karma

lmlamanna
Explorer

I know this is an old post, but I found it today when I was trying to do something similar.

My situation was slightly different. I have a lookup file that lists the report fields and also the order they needed to be.

Here is a run anywhere example illustrating how I solved this problem.

| makeresults 
| eval field1="test1", field2="test2", field3="test3"
| table [| makeresults | eval myfields="field1,field2,field3"| return $myfields]

gcusello
SplunkTrust
SplunkTrust

Hi amiragha,
you can pass field names as a token, e.g.:

<input type="checkbox" token="fieldstodisplay">
      <label>Fields to display</label>
      <choice value="_time">Date and Time</choice>
      <choice value="host">Host</choice>
      <choice value="source">Source</choice>
      <choice value="_raw">Log Event</choice>
      <default>_time,host,source,_raw</default>
      <initialValue>_time,host,source,_raw</initialValue>
      <delimiter> </delimiter>
    </input>

and then put in your table command the token $fieldstodisplay$.

Bye.
Giuseppe

0 Karma

vnravikumar
Champion

Hi @amiragha

The following code may help you, First build the dynamic column and pass that token dynamic_column to the actual query.

<form>
  <label>testtt</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="dynamic_column" depends="$hidethis$">
      <label>field2</label>
      <fieldForLabel>column</fieldForLabel>
      <fieldForValue>column</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>| makeresults 
| eval column="\"sourcetype\",\"index\",\"clientip\""
| fields column |head 1</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" | table $dynamic_column$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

vnravikumar
Champion

@amiragha Whether it works?

0 Karma

niketn
Legend

@amiragha please add more details to your question for the community to assist you better. Current description is quite confusing as the search attached is incorrect. Please add context to your question as to what you currently have (data and fields) and what is your expected output from the same.

While posting the details around data/fields, mask/anonymize any sensitive information that you may have!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What is the underlying problem you're trying to solve?

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...