Splunk Search

How do I use a value of an eval field to search an existing field

apvinod2003
Explorer

Hi Experts,

I have an input token $env_field$ which has a value: "port123_host123"
host, component and port are existing fields in splunk

I have a search that goes as follows: (basically need to extract the port from input token and use that value to search on the port field)

host=host123 component=cmp123| eval prtInput= replace($env_field$, "([^_]+)\_\w*", "\1")  | search port=prtInput

But this doesn't work. Eval expression is working, i.e., prtInput gets evaluated as "port123" and available as a field in the search result; I checked. But the search port=prtInput portion isn't returning any results somehow. search port=port123 returns results however.

Can't we use a value from eval field piped into a search command? If not, what alternatives do we have to achieve this?

Regards,
Vinod.

1 Solution

jacobwilkins
Communicator

Change:

| search port=prtInput

to

| where port==prtInput

View solution in original post

jacobwilkins
Communicator

Change:

| search port=prtInput

to

| where port==prtInput

apvinod2003
Explorer

That worked like a charm :). Thanks a lot.

0 Karma

ddrillic
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...