Splunk Search

use eval variable in my search

gpSplunk123
Engager

hi, i'm trying to use an eval variable in my search. i've tried many different things and i've failed, and i'm sure this is a quick easy solution but i just can't seem to get it.  my eval variables print out exactly as i need, i have validated it with the table as well as manually put it in the search as well.

 

| eval z="legolas,TGZ,ux*"
| eval name="*" + mvindex(split(z, ","), 0) + "*"
| eval type=mvindex(split(z, ","), 1)
| eval query="*" + mvindex(split(z, ","), 2)
| eval searchVar=if(type="JAR", name, query)
| table name, type, query, searchVar
| search artifactory=* uri=searchVar
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The search command doesn't support field names on the right side of an expression.  Try where, instead.  Also, the table command stripped out the artifactory field so the search will never find a match.

| eval z="legolas,TGZ,ux*"
| eval name="*" + mvindex(split(z, ","), 0) + "*"
| eval type=mvindex(split(z, ","), 1)
| eval query="*" + mvindex(split(z, ","), 2)
| eval searchVar=if(type="JAR", name, query)
| where (match(artifactory, ".*") AND uri=searchVar)

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

gpSplunk123
Engager

it didn't work for me, it still gave me 0 results found.  Replacing the search with the where clause.

0 Karma

richgalloway
SplunkTrust
SplunkTrust
Did you also remove the table command?
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...