topic Re: Use a Special characters in Reporting

Use a Special characters

Ant3xes — Wed, 28 Oct 2020 11:00:39 GMT

Hello,

I want to use the eval search command but i have a little problem.

index=* host="*" source="/applis" legs{}.status=* | eval error = if(legs{}.status == 200, "OK", "Problem") | chart count by error

When i use legs{}.status field it don't work, i think it's cause of my quotes.

Someone who know how to use that field ?

Thank you and sorry for my bad english

ITWhisperer — Wed, 28 Oct 2020 11:11:54 GMT

You need to put your field name in single quotes if it has a dot in. Try:

index=* host="*" source="/applis" 'legs{}.status'=* | eval error = if('legs{}.status' == 200, "OK", "Problem") | chart count by error

Ant3xes — Wed, 28 Oct 2020 11:19:51 GMT

Thank you ! I only tried with double quotes 😅