Splunk Search

Getting hold of an eval from subsearch

dhruv101
Path Finder

Hello,

How do I do something like this in splunk?

eval base_starttime = [search index="app_event"| eval starttime = strftime(sometime, someformat) | return starttime] | (then use base_startime ....)

Basically I want to get hold of an eval in subsearch to use in my base search.
Thanks.

0 Karma

HiroshiSatoh
Champion

Try this as an example.

[search (your search)|eval earliest=_time-60 | eval latest=_time+60 | table earliest latest | format "(" "(" "" ")" "OR" ")" ] 
0 Karma

dhruv101
Path Finder

Could you explain your solution. I understand that singular values like count can be accessed and stored using return $count. How do we obtain list type values?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...