Any way of achieving this: | makeresults | eval Column1="MyData" | eval TestField="Column1" | eval Result{TestField}=if('{TestField}'="MyData",1,0) The reason is simple. I want to define a lookup with all the fieldnames (columns) that is required for a specific category of events. My current search is larger than this, but i have found this example to describe my problem the best. if i solve this i can solve the rest. The result should be that ResultColumn1 = 1 {TestField} works on the left side of = but not on the right side in the eval. I tried every combination of TestField including (',",$,$$,<<) but i am not able to retrieve the data from the field which is defined in TestField. If i use {TestField} on the right side of = i get an error. This is why i have put '{TestField}' in my example above. I am using Enterprise 7.0.1 Any help is appreciated. ... View more

I can not get my head around this. I can see in the documentation that i should install and run the user commands on the search head. I have a hosting environment with several ldap directories (active directory) and different user setups on each host. Should i install the TA on each host to populate the posix_identities? I just can not see how the host and uid is resolved to a posix name on each server when the extraction is only installed on the splunk servers. Please enlighten me. ... View more