Splunk Search

intermediate storing of the results

damucka
Builder

Hello,

I have a dbxquery, that returns a table, where I am interested in one column, let us say c1.
Then in my search I have to unfortunately execute the map command, that wipes all the variables set before, also the c1.
The above steps I have to iterate several times.

How would I store the columns c1, .... cN and extract them at the end of my search?

Kind Regards,
Kamil

0 Karma

niketn
Legend

@damucka Can you share your existing query? Essentially you will be using the token c1 from your main query in the map search and assign it to a new field...

<yourSearchWhichReturnsC1Field>
| map search="search <yourSearchHereWhichReturnsRequiredResults>
                           | eval c1=$c1|s$"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

damucka
Builder

Hi @niketnilay

i would still need help with this.
I have following map command to test:

| eval host_to_trigger = "ls5979"
 | eval decision = 1

  | where isnotnull(host_to_trigger) and isnotnull(decision)

 | map maxsearches=20 search="dbxquery query=\"call SYS.MANAGEMENT_CONSOLE_PROC('runtimedump dump -f /usr/sap/ICP/HDB02/$host_to_trigger$/trace/DB_ICP/iAlerting_rtedump_ANOMALY_$triggertime$.trc','$host_to_trigger$:30240',?)\" connection=\"HANA_MLBSO_ICP\" | eval decision=$decision$ "

and the decision variable is not visible afterwards.
Could you please advise?

Kind Regards,
Kamil

0 Karma

damucka
Builder

Could you please change your answer into reply, that I can accept it?
Your solution would solve the issue as well of course.

Kind Regards,
Kamil

0 Karma

damucka
Builder

Thank you, I got the point.
The thing is however, that these are possibly more columns than only c1 and also there are more map commands in between. Then passing more and more results over the map command will make it a bit difficult to read.
I think I will use:
| outputtext usexml=false | fields - _raw | outputcsv sql_output.txt

to store the results and then inputcsv to restore the variables at the end.

Thank you for your help.

Kind regards,
Kamil

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...