How do concatenate a string with a token inside a Splunk query?

user_11461986 0
Viewed 180

I wanted to concatenate a token with a string inside a query. How should I accomplish this? For example, I have this token, $foo$ (Lets say this equals “foo” for this example) and a string “bar” and I want to combine them together to represent sourcetype=“foobar” inside my query search, how can I do that? I tried using eval sourcetype=concat($foo$, “bar”) But it didn’t work (I’m assuming because i tried this expression in the middle of a query, <query> index=some_dataset eval sourcetype=concat($foo$, “bar”) </query> Is there a way to do this inside a query?

I wanted to also add that this is for a dashboard

splunk xml
1 Answers

The eval command can't go before the first |. Nor can you use the concatenation operator (.) or the strcat function there.

Try setting a new token after $foo$ is defined.

<input token="foo" type="whatever">
   ...
   <change>
     <set token="foobar">$foo$bar</set>
   </change>
</input>
...
<query>index=some_dataset sourcetype=$foobar$</query>

Another option is a less-efficient query that computes the sourcetype before searching for it.

<query>index=some_dataset | eval st=$foo|s$."bar" | where sourcetype=st</query>
user_22274200
Related