Splunk Search

Usage of Token for eval function in dashboard query

bharathkumarnec
Communicator

Hi All,

How to use tokens in the eval function when we write query in the dashboard:

I have a token with name "IN" and have to use in the query like below:

index=abc | stats count as count1| eval xyz=if(count1>=0,"$IN$",1)

OR

index=abc | stats count as count1 | eval xyz="$IN$"

Kindly help me out on this issue.

Regards,
BK

0 Karma

woodcock
Esteemed Legend

You are doing it correctly; there must be some other problem.

0 Karma

somesoni2
Revered Legend

So you the syntax above are not working for you? What do you get when you use this?

0 Karma

bharathkumarnec
Communicator

@somesoni2, thnx for the reply...I had some typo error in my query, as my original query is too big I could not identify it...Fixed the issue and results are seen as expected.

0 Karma

rjthibod
Champion

Then please close / delete this question since it was user error.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...