assign value from another eval param

[eranhauser]

How to assign the value of param name original to the source in the | collect statement
index=123 

| eval original=abcd,

 | collect index=qaz source=original

[eranhauser]

Unfortunately it does not work. using sub search will change the query source value but not the collect one

[PickleRick]

More words please.

Subsearch is getting executed (and its results are substituted) where it's placed. So if you do

collect [...] sourcetype=[whatever subsearch you come up with]

It will work.

But that will give you one static value for the whole collect command.

If you want to dynamically assign the "destination" sourcetype per each event separately, you must use the hec format.

[eranhauser]

I edited my question. That works in two eval  parameters but not on the source parameter in the | collect

[PickleRick]

No. You can't do that. You need a constant parameter for the collect command. If you want to generate it dynamically, you need to do a subsearch from which you return the value of the parameter (the subsearch is executed before the main search).

Another option is to use the collect command with output_format=hec - then you can specify your metadata fields on a per-event basis but that's more complicated.

See https://docs.splunk.com/Documentation/Splunk/9.1.1/SearchReference/Collect

Collect is generally a relatively tricky command with some non-obvious restrictions (and uses your license if you use sourcetype different than the default stash one) so it's worth reading thoroughly the docs about it and test it on a dev environment before trying to run it in prod.

[PickleRick]

Like with a programming language (writing searches in SPL is a form of programming after all), the order of operations does matter.

So

| eval a=b,c=a

will yield different results than

| eval c=a,a=b