Splunk Search

Use result of eval to search in the same query

Path Finder

Hi,

Is this command not valid.


index=batch | eval newField = lower(strftime(strptime("2014-oct" + "01","%Y-%b%d"),"regular"+"%b%y")) | search newField

This command never returns any values. I have checked the basics. Just wondering if eval does not work this way. Thanks

1 Solution

Motivator

I think maybe the OP needs a subsearch-type syntax, because it looks like they are searching for the resulting value of the eval expression. So something like:

index=batch [| gentimes start=-1 | eval newField=... | table newField]

That should translate the subsearch expression into (newField=<value of eval expression>) and apply that to index=batch, which I think is what is being asked for here.

View solution in original post

Motivator

Just made it an answer.

0 Karma

Path Finder

The answer provided by aweitzman worked perfectly:


index=batch [| gentimes start=-1 | eval newField=... | table newField]

(If you want to post the answer I can mark it as solved)

Path Finder

So I figured it out. I didn't have the token linked to a fieldset element!

0 Karma

Revered Legend

Does the query works if you change the value in the input dropdown? Also, can you try by adding autoRun=True in the

?

0 Karma

Path Finder

I know the token is received in my dashboard because it is visible via http GET (?form.cn=2015-Feb). I do not have a submitButton, however I do have a input dropdown that has searchWhenChanged=true. Is it maybe the fact that I use the token within a for my chart?

0 Karma

Revered Legend

Did you verify if the token $cn$ is receiving values? Also, if your panels have autoRun=true or you have a Submit button? The message 'Waiting for input' does suggest that the tokens are not resolved.

0 Karma

Path Finder

Doesn't seem to change anything, no 😞

0 Karma

Motivator

Does putting quotes around it help?

...(strptime("$cn$"+"01",...

0 Karma

Path Finder

I manage to make this work when I have a hard coded value in the strptime function. However it does not work when I try and do the following :

index=batch AND [ search index=batch | eval partName=lower(strftime(strptime($cn$+"01","%Y-%b%d"),"regular"+"%b%y")) | table partName]

$cn$ being the value sent from another dashboard. The dashboard hangs on "Waiting for Input"

0 Karma

Motivator

I think maybe the OP needs a subsearch-type syntax, because it looks like they are searching for the resulting value of the eval expression. So something like:

index=batch [| gentimes start=-1 | eval newField=... | table newField]

That should translate the subsearch expression into (newField=<value of eval expression>) and apply that to index=batch, which I think is what is being asked for here.

View solution in original post

Revered Legend

This syntax does work fine. (Try below runanywhere sample)

|gentimes start=-1 |  eval newField = lower(strftime(strptime("2014-oct" + "01","%Y-%b%d"),"regular"+"%b%y")) | table newField

I guess the problem is with "search newField". This is like searching for string 'newField' in raw events and raw events doesn't have this field so no rows are returned. You should change this to "search newField=*" OR "where isnotnull(newField)"

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!