CODEWITHSUNDEEP
splunksplunk-querysplunk-formula
hba
hba

Reputation: 7800

Can I refer to a token dynamically in Splunk?

New to Splunk...

Not sure if there is a way to do this.

Let's say I have a token

<set token="token_1">one</set>
<set token="token_2">two</set>

Let's say I have another token:

<set token="qualifer">1</set>

Can I then do something like

<eval token="value"> token_{qualifer} </eval>

and basically set value to one (the value of token_1)? Effectively...

<set token="value"> one </set>

Upvotes: 0

Views: 581

Answers (1)

RichG
RichG

Reputation: 9926

Tokens in Splunk are referenced by enclosing the token name in $.

<eval token="value">token_$qualifer$</eval>

should work.

But what you want is a nested token reference, which would look something like this:

<eval token="value">$token_$qualifer$$</eval>

I'm not sure it will work.

Upvotes: 1

Related Questions