Splunk Search

Search Alias

gmg1956
New Member

Hi
I'm new on Splunk
It's possible to give an alias to a search?

I'm trying to do something like this:
index=Obs1 AS A or index= sourcetype =OBS2 AS B | eval mynormalizesidField=(If(index=="A",ID,ID))

What is the best way to give an alias to a complete search?

0 Karma

gdiogo
Explorer

Haha, the answers are exactly what I was looking for 🙂
However, it seems to me that it is really different from what the OP was asking for...
I think that most likely what you wished for is this :
| multisearch [search index=Obs1 | eval alias= "A"] [search index=* sourcetype =OBS2 | eval alias="B"] | eval mynormalizesidField=(If(alias=="A",ID,ID))
Basically, you run two differents search, mark in one field which corresponds to which and then do your formating (which you could easily conduct in the respective searches btw 😉 )

I guess the answer is quite late though... But might be upvoted if someone having the same problem as you find this post (quite unlinkely IMHO, since I guess the question is kind of named in a measleading way...)

I do not dare upvote the answers that helped me since objectively I do not think it answers the OP, but still thank you !

Edit: Link to multisearch Official Documentation : http://docs.splunk.com/Documentation/SplunkCloud/6.6.1/SearchReference/Multisearch

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can create a saved search with this search string and then use it like this

| savedsearch "name of your saved search"

See this for saving search http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchTutorial/Aboutsavingandsharingreports
More info on savedsearch commadn http://docs.splunk.com/Documentation/Splunk/6.3.0/SearchReference/Savedsearch

0 Karma

andrey2007
Contributor

May be the best way for you is to use search macro.
https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesearchmacros

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...