Splunk Search

set a value at search time

sbsbb
Builder

I made a Union with APPEND betwenn to search :

search1 APPEND [search2]

I want to have a field "source" that has a specific value, depending from the source query is there a way to do somthing like :

search1 source=1 | APPEND [search2 source=2]

and to have results like :

field1, field2, 1 (when comming from source1)
field1, field2, 2 (when comming from source2)

?

0 Karma
1 Solution

Ayn
Legend

Ayn
Legend

Sure. Have a look at eval which will do what you want.

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Eval

sbsbb
Builder

that exactly what I needed thank you

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...