Assign a value to the variable in Splunk and use that value in the search
问题 I have a use-case where I want to set the value to a variable based on the condition and use that variable in the search command. Example:- I want to check the condition if account_no=818 then var1="vpc-06b" else var1="*" I tried ...|eval val1=case(acc_no==818,"vpc-06b",acc_no!=818,"*")|search vpc_id=val1 but I am not getting any event. If I am trying ...|search vpc_id=vpc-06b then, as a result, I am getting the expected output. 回答1: index=... (acc-number=818 AND (vpc_id="vpc-078" OR vpc_id=