<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Dealing with field names with a period in it in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123279#M1252</link>
    <description>&lt;P&gt;Sorry to be unclear. Basically all I needed was to use single quotes around the field name as you instructed. Works fine now. Thanks for your help.&lt;/P&gt;</description>
    <pubDate>Fri, 30 Jan 2015 20:46:17 GMT</pubDate>
    <dc:creator>hcastell</dc:creator>
    <dc:date>2015-01-30T20:46:17Z</dc:date>
    <item>
      <title>Dealing with field names with a period in it</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123274#M1247</link>
      <description>&lt;P&gt;Hi all, I have the following in a macro that I'm basically using to retrieve a integer value that will be used later in my search string:&lt;/P&gt;

&lt;P&gt;| eval TestRxSNRTemp=split(Ipd.TestRxSNR," ") &lt;BR /&gt;
       | eval TestRxSNRValue=mvindex(TestRxSNRTemp,0) &lt;/P&gt;

&lt;P&gt;The value of Ipd.TestRxSNR field will typically be a value like 20db. I just need the 20. Using the above does not yield the result I'm looking for. Unfortunately, the fields with the period in the name are in input files (XML files) that I don't have any controller over.  I'm trying to figure out a way to work around this.  I was wondering if there was a way to use the field name (with the period) as is?  Thanks for your support.&lt;/P&gt;</description>
      <pubDate>Fri, 30 Jan 2015 20:00:23 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123274#M1247</guid>
      <dc:creator>hcastell</dc:creator>
      <dc:date>2015-01-30T20:00:23Z</dc:date>
    </item>
    <item>
      <title>Re: Dealing with field names with a period in it</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123275#M1248</link>
      <description>&lt;P&gt;I'm not entirely sure what you're asking here. To use fields with special characters in them in eval and where functions you'd use single quotes to refer to the fields. (E.x. 'lpd.TestRxSNR' ) If you're having trouble extracting a value, you could also consider the &lt;A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/rex"&gt;rex command&lt;/A&gt; to use a regular expression instead.&lt;/P&gt;</description>
      <pubDate>Fri, 30 Jan 2015 20:11:15 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123275#M1248</guid>
      <dc:creator>acharlieh</dc:creator>
      <dc:date>2015-01-30T20:11:15Z</dc:date>
    </item>
    <item>
      <title>Re: Dealing with field names with a period in it</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123276#M1249</link>
      <description>&lt;P&gt;Sorry to be unclear.  Basically all I needed was to use single quotes around the field name as you instructed.  Works fine now.  Thanks for your help.&lt;/P&gt;</description>
      <pubDate>Fri, 30 Jan 2015 20:29:11 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123276#M1249</guid>
      <dc:creator>hcastell</dc:creator>
      <dc:date>2015-01-30T20:29:11Z</dc:date>
    </item>
    <item>
      <title>Re: Dealing with field names with a period in it</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123277#M1250</link>
      <description>&lt;P&gt;If possible, @acharlieh, please convert your comment to an answer and @hcastell, mark it as accepted. Thanks ! &lt;/P&gt;</description>
      <pubDate>Fri, 30 Jan 2015 20:34:02 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123277#M1250</guid>
      <dc:creator>aljohnson_splun</dc:creator>
      <dc:date>2015-01-30T20:34:02Z</dc:date>
    </item>
    <item>
      <title>Re: Dealing with field names with a period in it</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123278#M1251</link>
      <description>&lt;P&gt;Converted!&lt;/P&gt;</description>
      <pubDate>Fri, 30 Jan 2015 20:44:27 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123278#M1251</guid>
      <dc:creator>acharlieh</dc:creator>
      <dc:date>2015-01-30T20:44:27Z</dc:date>
    </item>
    <item>
      <title>Re: Dealing with field names with a period in it</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123279#M1252</link>
      <description>&lt;P&gt;Sorry to be unclear. Basically all I needed was to use single quotes around the field name as you instructed. Works fine now. Thanks for your help.&lt;/P&gt;</description>
      <pubDate>Fri, 30 Jan 2015 20:46:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123279#M1252</guid>
      <dc:creator>hcastell</dc:creator>
      <dc:date>2015-01-30T20:46:17Z</dc:date>
    </item>
    <item>
      <title>Re: Dealing with field names with a period in it</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123280#M1253</link>
      <description>&lt;P&gt;Periods shouldn't pose a problem. Try using the &lt;CODE&gt;rename&lt;/CODE&gt; command to rename one of your fields to include a &lt;CODE&gt;.&lt;/CODE&gt;; no worries there.&lt;/P&gt;

&lt;P&gt;There are a ton of ways to approach this. The first thought, personally, is to use regular expressions ! Here is but one way; if it doesn't work just post a comment and I'll revise.&lt;/P&gt;

&lt;P&gt;There is a cool &lt;CODE&gt;sed&lt;/CODE&gt; mode on the &lt;CODE&gt;rex&lt;/CODE&gt; command, check it like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| rex field=Ipd.TestRxSNR mode=sed "s/[^0-9]//g"
&lt;/CODE&gt;&lt;/PRE&gt;

&lt;P&gt;&lt;STRONG&gt;What's this black magic?&lt;/STRONG&gt; you screech? Ah, nothing but a global blank substitution for anything that isn't a number in the field we specify.&lt;/P&gt;</description>
      <pubDate>Fri, 30 Jan 2015 21:23:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123280#M1253</guid>
      <dc:creator>aljohnson_splun</dc:creator>
      <dc:date>2015-01-30T21:23:17Z</dc:date>
    </item>
    <item>
      <title>Re: Dealing with field names with a period in it</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123281#M1254</link>
      <description>&lt;P&gt;Thanks for the suggestion.  May try that one day. This time around the single quote did the trick.&lt;/P&gt;</description>
      <pubDate>Fri, 30 Jan 2015 22:30:57 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Dealing-with-field-names-with-a-period-in-it/m-p/123281#M1254</guid>
      <dc:creator>hcastell</dc:creator>
      <dc:date>2015-01-30T22:30:57Z</dc:date>
    </item>
  </channel>
</rss>

