I am using a table of results
a | b | c | search | d | e
===============================================
xx yy zzz index=firstindex bb ppp
yyy qqq eeee index=secondindex rr sss
ttt zxc asd index=thirdindex uy mmm
based on each result, I would like to perform a foreach command to loop through each row of results based on the "search" field and perform a subsearch based on the VALUES in the "search" field, from a coding's perspective it would be something like
for each row:
if field= search:
#use value in search
[search value | return index to main search]
it should evaluate to something like this for each row
if field=search:
[search index=index1 | return index]
My desired output is:
index
==============
firstindex
secondindex
thirdindex
Is this possible? I have tried using
foreach * [eval if <<FIELD>>=="search"[search <<FIELD>>] ","[search <<FIELD>>]]
but this does not seem to work.
Tried looking around in splunk community forums but the queries do not seem to be the same as what I am intending to do
Hi @splunk_new1,
You can try using map command. Since it is not clear, your final desired output I cannot give you a sample. Please check the documentation below;
https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Map
Hi,
Thanks for your reply. I have posted an update to my question with my desired output.
I am aware of the map command, however as my field results have the word index= before the actual index name, I am unable to do a
search
========================
index=firstindex
index=secondindex
index=thirdindex
|map search="search index=$search$"
as I believe ^ would resolve to map search="search index=index=firstindex
This would be an error. Is there anyway I can do something like
|map search="search $search$| stats values(index)"
and have it return something like
index
==========
firstindex
secondindex
thirdindex