I am using a table of results  a | b | c | search | d | e =============================================== xx yy zzz index=firstindex bb ppp yyy qqq eeee index=secondindex rr sss ttt zxc asd index=thirdindex uy mmm based on each result,  I would like to perform a  foreach command to loop through each row of results based on the "search" field and perform a subsearch based on the VALUES in the "search" field,  from a coding's perspective it would be something like  for each row: if field= search: #use value in search [search value | return index to main search] it should evaluate to something like this for each row if field=search: [search index=index1 | return index] My desired output is:  index ============== firstindex secondindex thirdindex    Is this possible? I have tried using  foreach * [eval if <<FIELD>>=="search"[search <<FIELD>>] ","[search <<FIELD>>]] but this does not seem to work.  I am aware of the map command, however as my field results have the word index= before the actual index name, I am unable to do a  search ======================== index=firstindex index=secondindex index=thirdindex |map search="search index=$search$"  as I believe ^ would  resolve to map search="search index=index=firstindex " This would be an error. Is there anyway I can do something like  |map search="search $search$| stats values(index)" and have it return something like index ========== firstindex secondindex thirdindex Tried looking around in splunk community forums but they seem to point at map instead of foreach, I am really lost in how I can get around this issue and achieving my desired output, it would be great if someone with more splunk experience can assist me ... View more

I am using a table of results    a | b | c | search | d | e =============================================== xx yy zzz index=firstindex bb ppp yyy qqq eeee index=secondindex rr sss ttt zxc asd index=thirdindex uy mmm   based on each result,  I would like to perform a  foreach command to loop through each row of results based on the "search" field and perform a subsearch based on the VALUES in the "search" field,  from a coding's perspective it would be something like    for each row: if field= search: #use value in search [search value | return index to main search] it should evaluate to something like this for each row if field=search: [search index=index1 | return index]   My desired output is:    index ============== firstindex secondindex thirdindex    Is this possible? I have tried using  foreach * [eval if <<FIELD>>=="search"[search <<FIELD>>] ","[search <<FIELD>>]] but this does not seem to work.  Tried looking around in splunk community forums but the queries do not seem to be the same as what I am intending to do ... View more