topic Re: Foreach Not Working in Splunk Search

Foreach Not Working

IRHM73 — Fri, 05 Apr 2019 09:15:29 GMT

Hi,

I wonder whether someone can help me please.

I've put together the following query:

`real-time-information_wmf(ServiceRequestReceived)` 
| rex field=detail.filterFields "\((?<myField>.*)\)" 
| makemv myField 
| mvexpand myField
| makemv delim="," myField
| eval wibble {myField}=myField
| eval header=""
| foreach wibble* [eval header=header+'<<MATCHSTR>>']
| chart sum(wibble*) as wibble* by _time

There are a couple of issues with this.

On the eval wibble line, the new field has a comma added to the field name, even though it's been removed on the makemv line.

Then the second and most important issue is that when I run the query, the chart only shows the 'wibble fieldnames.

I just wondered whether someone could look at this please and let me know where I've gone wrong.

Many thanks and kind regards

Chris

Re: Foreach Not Working

kamlesh_vaghela — Fri, 05 Apr 2019 09:26:00 GMT

@IRHM73

Can you please share sample event and expected output?

Re: Foreach Not Working

IRHM73 — Thu, 11 Apr 2019 05:42:44 GMT

Hi @kamlesh_vaghela.

Thank you for getting in touch with me, and I'm so sorry it's taken some time to come back to you.

I have come up with the following solution:

`real-time-information_wmf(ServiceRequestReceived)` 
| rex field=detail.filterFields "\((?<Fields>.*)\)" 
| makemv Fields 
| makemv delim="," Fields 
| mvexpand Fields
| eval nField {Fields}=Fields
| foreach nField* [eval <<MATCHSTR>> = '<<FIELD>>']
| chart values(detail.serviceName) AS "Service Name" count(nField*) as * by _time

Many thanks and kind regards

Chris

Re: Foreach Not Working

kamlesh_vaghela — Thu, 11 Apr 2019 06:15:19 GMT

@IRHM73

Great. Please accept your answer.