Splunk Search

How to assign value of one field to a variable?

ppanchal
Path Finder

I have data in my log which looks like,

extraData:  {   [-] 
         MD_independent_new:     2016-11-30T04:35:57Z   
         MD_sitedependent_new:   2016-11-30T17:31:22Z   
         app_version_build_id:   20161109   
         db_version:     27 
         device_id:  A000003088E203 
         driver_id:  090201 
         login_environment:  Production 
         site_id:    S04160 : Irvine Hauling    
         vehicle_id:     104681 
    }   

To extract fields from this log, I have my search like,

index=mint | table extraData.site_id

Is there a way I can assign the value of extraData.site_id to another variable?

My below search string fails,

index=mint |eval temp=extraData.site_id| table temp

Please assist.

0 Karma

gokadroid
Motivator

Please see the documentation examples here on how to use output to save the value in the variable:

http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Spath#1._Specify_output_and_path_f...

Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...