×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
mseijos
Engager
Member since: ‎11-26-2019
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 3
Member Since ‎11-26-2019
Activity Feed
View All

Re: Read a field value which field name is in anot...

by in Splunk Search
‎11-29-2019 12:09 AM
‎11-29-2019 12:09 AM
I tried your solution with this code: | makeresults | eval a="1" | eval b="2" | eval name="a" | foreach name [ eval value="<<FIELD>>" ] But "value" field gets the literal "name" as value. If I remove the quotes in <<FIELD>> , I get the literal "a" in "value" field. The expected "value" field would be "1" ... View more

How to read a field value which field name is in a...

by in Splunk Search
‎11-28-2019 07:42 AM
3 Karma
‎11-28-2019 07:42 AM
3 Karma
We have this table: And we want to have a field (for example, named "value") that gets the value of the field which name is in the "name" field. In the first row it would be value=3d, in the second row value would be value=1 Its similar to what | eval {name} = "whatever" would do, but reading instead of writing. (something like | eval value = {name} but that doesn't work). ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM
Karma from
View All