Splunk Search

How to assign value of one field to a variable?

ppanchal
Path Finder

I have data in my log which looks like,

extraData:  {   [-] 
         MD_independent_new:     2016-11-30T04:35:57Z   
         MD_sitedependent_new:   2016-11-30T17:31:22Z   
         app_version_build_id:   20161109   
         db_version:     27 
         device_id:  A000003088E203 
         driver_id:  090201 
         login_environment:  Production 
         site_id:    S04160 : Irvine Hauling    
         vehicle_id:     104681 
    }   

To extract fields from this log, I have my search like,

index=mint | table extraData.site_id

Is there a way I can assign the value of extraData.site_id to another variable?

My below search string fails,

index=mint |eval temp=extraData.site_id| table temp

Please assist.

0 Karma

gokadroid
Motivator

Please see the documentation examples here on how to use output to save the value in the variable:

http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Spath#1._Specify_output_and_path_f...

Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...