I am using a table of results
a | b | c | search | d | e
===============================================
xx yy zzz index=firstindex bb ppp
yyy qqq eeee index=secondindex rr sss
ttt zxc asd index=thirdindex uy mmm
based on each result, I would like to perform a foreach command to loop through each row of results based on the "search" field and perform a subsearch based on the VALUES in the "search" field, from a coding's perspective it would be something like
for each row:
if field= search:
#use value in search
[search value | return index to main search]
it should evaluate to something like this for each row
if field=search:
[search index=index1 | return index]
My desired output is:
index
==============
firstindex
secondindex
thirdindex
Is this possible? I have tried using
foreach * [eval if <<FIELD>>=="search"[search <<FIELD>>] ","[search <<FIELD>>]]
but this does not seem to work.
I am aware of the map command, however as my field results have the word index= before the actual index name, I am unable to do a
search
========================
index=firstindex
index=secondindex
index=thirdindex
|map search="search index=$search$"
as I believe ^ would resolve to map search="search index=index=firstindex "
This would be an error. Is there anyway I can do something like
|map search="search $search$| stats values(index)"
and have it return something like
index
==========
firstindex
secondindex
thirdindex
Tried looking around in splunk community forums but they seem to point at map instead of foreach, I am really lost in how I can get around this issue and achieving my desired output, it would be great if someone with more splunk experience can assist me
