Splunk Search

How to assign value of one field to a variable?

ppanchal
Path Finder

I have data in my log which looks like,

extraData:  {   [-] 
         MD_independent_new:     2016-11-30T04:35:57Z   
         MD_sitedependent_new:   2016-11-30T17:31:22Z   
         app_version_build_id:   20161109   
         db_version:     27 
         device_id:  A000003088E203 
         driver_id:  090201 
         login_environment:  Production 
         site_id:    S04160 : Irvine Hauling    
         vehicle_id:     104681 
    }   

To extract fields from this log, I have my search like,

index=mint | table extraData.site_id

Is there a way I can assign the value of extraData.site_id to another variable?

My below search string fails,

index=mint |eval temp=extraData.site_id| table temp

Please assist.

0 Karma

gokadroid
Motivator

Please see the documentation examples here on how to use output to save the value in the variable:

http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Spath#1._Specify_output_and_path_f...

Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...