Splunk Search

How can I refer part of query as a table?

jonvijay1993
Explorer

I have a dbx query plus SPL commands that makes me a certain table, which I want to refer to via a table name, is it possible?

 

The present table needs some new columns and that's what the above query adds, but the schema for my final table for my bar chart is a little different from the source table and hence I can't build on top of the above query using |, or I don't know how. Hence I was wondering if I can just use this via a table name.

Labels (6)
0 Karma

jonvijay1993
Explorer

My use case is I want to change this

select * from (an entire query replacing a table name)

to

select * from a_table

normally I would add the query in the table name as an emergency solution but the query has dbxquery and join etc that makes splunk go crazy.

 

I shall look into named searches, thank you! Will get back to you!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There is a mixture of naming here - You can saved a search as a named search which you can execute in another search. Does this satisfy your usecase?

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...