Splunk Search

Eval field value evaluating correctly, but has no impact when used later down the road in the search query

des_esse_err
Explorer

It's a simple search query. It needs to find events containing a file name which will change every month.

The eval command should return YYmm* (1412*).

This query works
The eval field signatureVersionCriteria has been replaced -hard coded- with the value it should hold.
The field values shown in a table do indeed display "1412*" for the signatureVersionCriteria field.

index=xxx_app_sep | eval signatureVersionCriteria = strftime(now(), "%y%m") + "*" | search signature_version="1412*"| table signature_version, signatureVersionCriteria

This query does not work
It returns nothing.

index=xxx_app_sep | eval signatureVersionCriteria = strftime(now(), "%y%m") + "*" | search signature_version = signatureVersionCriteria | table signature_version, signatureVersionCriteria

Went through quite a lots of posts, similar to this, but could not figure it out.
Many thanks.
D

Tags (1)
0 Karma
1 Solution

aholzer
Motivator

Try the following:

index=xxx_app_sep | eval signatureVersionCriteria = strftime(now(), "%y%m") | where like(signature_version,signatureVersionCriteria."%") | table signature_version, signatureVersionCriteria

View solution in original post

aholzer
Motivator

Try the following:

index=xxx_app_sep | eval signatureVersionCriteria = strftime(now(), "%y%m") | where like(signature_version,signatureVersionCriteria."%") | table signature_version, signatureVersionCriteria

des_esse_err
Explorer

Hello! Many thanks it does indeed work.

0 Karma

somesoni2
Revered Legend

Hi David,

If Aleksander's answer has solved your problem, please accept the answr by clicking on the tick-mark+Accept button below the answer. This will help other users with similar problem to identify the correct solution and you both will get points.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...