How to add dynamic value in search query?

[s0k0]

I have created a post curl to add data in Splunk, internally my api hits Splunk api and in that api I send data in body & that data would get created in my splunk table.
I want to add dynamic value in search query of splunk api.
How can i achieve that, please help here

method: "POST",

path: "/api/addSplunk",

handler: async (request, h) => {

const ccmData = getServerConfig(request);

const url = ccmData["splunkApiUrl"];

const ChannelName= request.payload.channel_name;  // I want to use this value in search query

const Channel= request.payload.channel_type;

function xmlTranslate(resp) {

return resp.text()

}

const httpsAgent = new https.Agent({

rejectUnauthorized: false

});

const options = {

method: "POST",

headers: {

"Authorization": "dr356654fy6,

"Content-Type": "application/x-www-form-urlencoded"

},

agent: httpsAgent,

translate: xmlTranslate,

body: 'search=| makeresults | eval Channel ="372864u31564719" | eval ChannelName = "4P customer" | table Channel,ChannelName | outputlookup channel.csv append=true'

};

const res = await fetch(url, options, xmlTranslate);

Right now I have hardcoded like this eval Channel ="372864u31564719" | eval ChannelName = "4P customer", I want to add dynamic value for diff use case in channel and channelName of search query (i.e coming from request payload)

[s0k0]

Hi @TrangCIC81 I tried this, didn't work.

@VatsalJagani thank you so much, it works !!

[VatsalJagani]

@s0k0 - I'm glad that it works!! Kindly consider accepting my answer which helped you resolve your question, so that other community members can easily see it.

[TrangCIC81]

Can you verify if the values for ChannelName and Channel do not contain any special characters that might interfere with the construction of the string in the body of the request?

Also try logging the values of ChannelName and Channel to the console to verify that they are being properly read.

[s0k0]

Yes, it doesn't have any special character, inside options object ChannelName and Channel value is not getting read.

Outside option object it's value is getting read, I did console and check.
So I put whole query outside the option object then get the dynamic value and append in body

const query = `| makeresults | eval Channel="${Channel}" | eval ChannelName="${ChannelName}" | table Channel,ChannelName | outputlookup channel.csv append=true`;

const options = {

method: "POST",

headers: {

"Authorization": authToken,

"Content-Type": "application/x-www-form-urlencoded"

},

agent: httpsAgent,

translate: xmlTranslate,

body: `search=${query}`

};

This works !!

Thank you so much for resolving.

[TrangCIC81]

Ah ok. No problem. 
Cheers!!

[VatsalJagani]

@s0k0 - You can use query with variables, something like this:

const ChannelName= request.payload.channel_name;
const Channel= request.payload.channel_type;
const query = `| makeresults | eval Channel="${Channel}" | eval ChannelName="${ChannelName}" | table Channel,ChannelName | outputlookup channel.csv append=true`;
const options = {
  method: "POST",
  headers: {
    "Authorization": "dr356654fy6",
    "Content-Type": "application/x-www-form-urlencoded"
  },
  agent: httpsAgent,
  translate: xmlTranslate,
  body: `search=${encodeURIComponent(query)}`
};

Kindly upvote if you find it useful!!!

[TrangCIC81]

To add dynamic values to your Splunk search query, you can use string interpolation. Here's an example of how you can modify your code to use the values from the request payload.
Let me know if it works.

method: "POST",
path: "/api/addSplunk",
handler: async (request, h) => {
    const ccmData = getServerConfig(request);
    const url = ccmData["splunkApiUrl"];
    const ChannelName = request.payload.channel_name;
    const Channel = request.payload.channel_type;

    function xmlTranslate(resp) {
        return resp.text()
    }

    const httpsAgent = new https.Agent({
        rejectUnauthorized: false
    });

    // Use string interpolation to insert dynamic values in the search query
    const query = `| makeresults | eval Channel="${Channel}" | eval ChannelName="${ChannelName}" | table Channel,ChannelName | outputlookup channel.csv append=true`;

    const options = {
        method: "POST",
        headers: {
            "Authorization": "dr356654fy6",
            "Content-Type": "application/x-www-form-urlencoded"
        },
        agent: httpsAgent,
        translate: xmlTranslate,
        body: `search=${encodeURIComponent(query)}`
    };