Splunk Search

eval,passing a value in eval

jaygamini
New Member

Hi all,

Please help me … not been success in passing the output of the search into a new search (different table).

index=voipdata 01448ACD5A7CCC212AFD039D
|stats values(MSISDN) as MSISDN|rex field=MSISDN "(?\d+)"|eval V5CallRoute1=if(tdr="V5CallRoute" AND PAITEL="{tel:+%phone%}",CallDataKey,NULL)
|table V5CallRoute1

Line by line explanation ...
index=voipdata 01448ACD5A7CCC212AFD039D |stats values(MSISDN) as MSISDN
// This returns a phone number {18433231540}
rex field=MSISDN "(?\d+)"
//This will format the above output to remove the bracket, hence 18433231540
eval V5CallRoute1=if(tdr="V5CallRoute" AND PAITEL="{tel:+%phone%}",CallDataKey,NULL)
//This is where I need help. Essentially , I’m searching the phone number on “V5CallRoute” table now. Here is an example of the field “PAITEL” -> PAITEL={tel:+18433231540} . So I ‘m trying to pass variable “phone” , apparently not getting any output.

Thanks

Tags (2)
0 Karma

harsmarvania57
Ultra Champion

Hi,

As you are doing |stats values(MSISDN) as MSISDN, fields (tdr , CallDataKey , PAITEL) which require in eval is dropped by stats command

so I have created run anywhere search with some sample data and it is producing desired output

| makeresults | eval MSISDN="{18433231540}", tdr="V5CallRoute", PAITEL="{tel:18433231540}", CallDataKey="test123"
| stats values(MSISDN) as MSISDN, values(tdr) AS tdr, values(CallDataKey) AS CallDataKey, values(PAITEL) AS PAITEL
| rex field=MSISDN "(?<phone>\d+)"
| eval V5CallRoute1=if(tdr="V5CallRoute" AND PAITEL="{tel:"+phone+"}",CallDataKey,NULL)
| table V5CallRoute1

So in your case your query will be

index=voipdata 01448ACD5A7CCC212AFD039D
| stats values(MSISDN) as MSISDN, values(tdr) AS tdr, values(CallDataKey) AS CallDataKey, values(PAITEL) AS PAITEL
| rex field=MSISDN "(?<phone>\d+)"
| eval V5CallRoute1=if(tdr="V5CallRoute" AND PAITEL="{tel:"+phone+"}",CallDataKey,NULL)
| table V5CallRoute1

I hope this helps.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...