Splunk Search

for every command we filter fields and giving few fields to the next command, why eval gives all fields to the next command

nagarjuna280
Communicator

index=* sourcetype=history browser=chrome | eval name="raj" giving output as many fields like sourecetype, browser, host etc...

index=* sourcetype=history browser=chrome |table sourcetype gives only sourcetype

is there any command like eval

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

The initial search gives all fields to eval, and eval adds one field to that set.
You can combine commands like this:

index=* sourcetype=history browser=chrome | table sourcetype | eval name="raj"

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

The initial search gives all fields to eval, and eval adds one field to that set.
You can combine commands like this:

index=* sourcetype=history browser=chrome | table sourcetype | eval name="raj"
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...