topic Re: Why isn't this eval'd field available? in Getting Data In

Why isn't this eval'd field available?

LordVoldemort — Mon, 28 Sep 2020 12:11:25 GMT

I've got a query like this:

Why is date_numericmonth empty in the resulting table? The sorting works as you would expect, and date_month shows up in the table just fine, so the date_numericmonth has a meaningful value, but for some reason I can't get it to show up in the results.

Re: Why isn't this eval'd field available?

gkanapathy — Thu, 02 Aug 2012 21:20:32 GMT

What fields are in the stats commands? Note that if _time is not a field output from stats, then the eval will yield a null. Also note that the date_* fields are basically independent of the _time field (and in fact may not be the same, since _time is UTC, while date_* is event text time) so even if they're there, time may not be.

Re: Why isn't this eval'd field available?

LordVoldemort — Mon, 28 Sep 2020 12:11:28 GMT

The stats is using the date_x fields, but the thing that confuses me is that the date_numericmonth is working for the sort command. I didn't realize that _time was necessary in UTC though. It seems like I might be better off extracting all of my date fields through evals()s, and if I understand correctly, all I need to do to make sure I can return all of them is aggregate by them in the stats command.

Re: Why isn't this eval'd field available?

gkanapathy — Thu, 02 Aug 2012 21:29:15 GMT

I guess I don't see why you wouldn't just | sort - _time instead.

Re: Why isn't this eval'd field available?

LordVoldemort — Thu, 02 Aug 2012 22:37:31 GMT

The sorting is a bit complicated, look at the asc, and desc's. Mostly though, I want to use the date_numericmonth in the splunk results and I can't if it isn't being returned.