Hi I am searching for an option to dynamically assign value for MAXSPAN in a transaction. The value should come as a result of a LOOKUP. So far I have no success whatsoever. I have tried the propose...
See more...
Hi I am searching for an option to dynamically assign value for MAXSPAN in a transaction. The value should come as a result of a LOOKUP. So far I have no success whatsoever. I have tried the proposed solution here: https://community.splunk.com/t5/Splunk-Search/How-to-dynamic-assign-variable-to-maxspan-and-span/m-p/398004 however this does not work for me, in particular the proposed solution "fixes" the maxspan to the value in the eval expression. which is 7m in this case. | makeresults | eval maxspan="7m"
| map search="search index=_* | transaction host maxspan=$maxspan$" in essence i would like to be able to notify myself for related events that happen for a certain period of time, however that time and the number of event per each type is dynamically assigned as per the lookup. here is an example of my search line: sourcetype=servername host=hostname |lookup flex_test f1 as f1 OUTPUT mx_span AS mx_span , ev_count AS ev_count |transaction f1 f2 maxspan={dynamic value should come here} |eval alert = if(eventcount>ev_count,"ev_ALERT","OK") |...... and here is an example of the lookup table (tried different formats) f1,mx_span,ev_count 34,1,5 35,60,10 36,2m,5 kind regards!