Splunk Search

My Named Searches are being Audited, can I put a title on my search?

mcm10285
Communicator

Our named searches are being audited. Named searches are those that have a specific User name in the actual search syntax. Those are audited and I would like to find a way to attach a ticket number to the search so a named search would be labeled by a ticket number.

Is there a way to do this on an inline search?

Tags (3)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

My only suggestion would be for you to stick an extraneous eval command in the middle of the search, e.g., from:

sourcetype=mysourcetype userid=xyz | stats count by source_ip

to

sourcetype=mysourcetype userid=xyz | eval ticket_number="ABC1234567" | stats count by source_ip

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

My only suggestion would be for you to stick an extraneous eval command in the middle of the search, e.g., from:

sourcetype=mysourcetype userid=xyz | stats count by source_ip

to

sourcetype=mysourcetype userid=xyz | eval ticket_number="ABC1234567" | stats count by source_ip

mcm10285
Communicator

That's it! So simple! Thank you!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...