Splunk Search

How to include an app name as a part of the search query?

nibinabr
Communicator

Is there a way by which I can get the app name as the part of the search query. Something like

index=myindex | eval my_app_name=$app_name$|

So if I'm executing the query above in the search and reporting app, my_app_name should be searched.

Thanks

Tags (4)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could do this:

  index=myindex | eval [rest /services/search/jobs splunk_server=local | addinfo | where sid = info_sid | rename eai:acl.app as my_app_name | return my_app_name]

View solution in original post

sloshburch
Splunk Employee
Splunk Employee

I just discovered that, starting with 6.5.0, there's some sweet new global tokens!

One of which is $env:app$

http://docs.splunk.com/Documentation/Splunk/6.5.1/Viz/tokens#Use_global_tokens_to_access_environment...

martin_mueller
SplunkTrust
SplunkTrust

You could do this:

  index=myindex | eval [rest /services/search/jobs splunk_server=local | addinfo | where sid = info_sid | rename eai:acl.app as my_app_name | return my_app_name]

Dawson014
Path Finder

Thanks! Just what I needed!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

No luck with relative URLs?

0 Karma

nibinabr
Communicator

I'm trying to build a dashboard that performs some operations on the URL en-US/app/app_name/ and I want this dashboard to work on all the apps without trying to change the app name.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

I'm with @alacercogitatus though, curious what you're trying to achieve here.

0 Karma

nibinabr
Communicator

Exactly what I was looking for.
Thanks

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

What are you trying to achieve here? Why would you want the app name in the search query?

0 Karma

rharrisssi
Path Finder

What are you trying to achieve with that question? It's passive aggressive and unhelpful.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...