Splunk Search

Using variable

jimjohn
Path Finder

My search string is
(host=ABC AND "Emp Code"=inputString) OR (host=joinHost AND "EMPLOYER_CODE"=inputString)
Can I have a common varible in place of inputString.

I tried using using eval like below.
eval inupt=inputString|(host=ABC AND "Emp Code"=inputString) OR (host=joinHost AND "EMPLOYER_CODE"=inputString)
But not getting result.

Any help

0 Karma

kristian_kolb
Ultra Champion

No, not the way you describe it.

You cannot start with an eval that way. You might get away with something like;

host=ABC OR host=joinHost inputString | blah blah blah

Which will search through the events for inputString, regardless of whether it appears in a field or not. But since inputString is treated as a literal string, rather than a field value, your search may return results where inputString is present in other parts of the event.

/k

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...