Splunk Search

Table fields as variable

amiragha
New Member

Is there anyway to pass a variable to the table command? Basically, I have field1, field2 and field3 from my search. I cannot get this to work

eval myfields="field1,field2,field3)
| table myfields

Tried | Table $myfields$ too

Just trying to get | table field1 field2 field3

Thanks for any help

0 Karma

lmlamanna
Explorer

I know this is an old post, but I found it today when I was trying to do something similar.

My situation was slightly different. I have a lookup file that lists the report fields and also the order they needed to be.

Here is a run anywhere example illustrating how I solved this problem.

| makeresults 
| eval field1="test1", field2="test2", field3="test3"
| table [| makeresults | eval myfields="field1,field2,field3"| return $myfields]

gcusello
SplunkTrust
SplunkTrust

Hi amiragha,
you can pass field names as a token, e.g.:

<input type="checkbox" token="fieldstodisplay">
      <label>Fields to display</label>
      <choice value="_time">Date and Time</choice>
      <choice value="host">Host</choice>
      <choice value="source">Source</choice>
      <choice value="_raw">Log Event</choice>
      <default>_time,host,source,_raw</default>
      <initialValue>_time,host,source,_raw</initialValue>
      <delimiter> </delimiter>
    </input>

and then put in your table command the token $fieldstodisplay$.

Bye.
Giuseppe

0 Karma

vnravikumar
Champion

Hi @amiragha

The following code may help you, First build the dynamic column and pass that token dynamic_column to the actual query.

<form>
  <label>testtt</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="dynamic_column" depends="$hidethis$">
      <label>field2</label>
      <fieldForLabel>column</fieldForLabel>
      <fieldForValue>column</fieldForValue>
      <selectFirstChoice>true</selectFirstChoice>
      <search>
        <query>| makeresults 
| eval column="\"sourcetype\",\"index\",\"clientip\""
| fields column |head 1</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index="_internal" | table $dynamic_column$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
      </table>
    </panel>
  </row>
</form>
0 Karma

vnravikumar
Champion

@amiragha Whether it works?

0 Karma

niketn
Legend

@amiragha please add more details to your question for the community to assist you better. Current description is quite confusing as the search attached is incorrect. Please add context to your question as to what you currently have (data and fields) and what is your expected output from the same.

While posting the details around data/fields, mask/anonymize any sensitive information that you may have!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

What is the underlying problem you're trying to solve?

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...