https://community.splunk.com/t5/Splunk-Search/Eval-command-on-a-field-with-multiple-words/m-p/50291#M12084 <P>I want to use the eval command to create another field using an existing field. However, the existing field has multiple words. Normally, I would use quotation marks around the field, but eval treats that as a string.</P> <PRE><CODE>|eval newfield="My Old Field" </CODE></PRE> <P>This code would simple use the string "my Old Field" instead of values from a field called "My Old Field". How do i fix this?</P> Mon, 04 Mar 2013 18:45:54 GMT cmak 2013-03-04T18:45:54Z https://community.splunk.com/t5/Splunk-Search/Eval-command-on-a-field-with-multiple-words/m-p/50291#M12084 <P>I want to use the eval command to create another field using an existing field. However, the existing field has multiple words. Normally, I would use quotation marks around the field, but eval treats that as a string.</P> <PRE><CODE>|eval newfield="My Old Field" </CODE></PRE> <P>This code would simple use the string "my Old Field" instead of values from a field called "My Old Field". How do i fix this?</P> Mon, 04 Mar 2013 18:45:54 GMT https://community.splunk.com/t5/Splunk-Search/Eval-command-on-a-field-with-multiple-words/m-p/50291#M12084 cmak 2013-03-04T18:45:54Z https://community.splunk.com/t5/Splunk-Search/Eval-command-on-a-field-with-multiple-words/m-p/50292#M12085 <PRE><CODE>|eval newfield=$My Old Field$ </CODE></PRE> Mon, 04 Mar 2013 19:05:07 GMT https://community.splunk.com/t5/Splunk-Search/Eval-command-on-a-field-with-multiple-words/m-p/50292#M12085 jonuwz 2013-03-04T19:05:07Z https://community.splunk.com/t5/Splunk-Search/Eval-command-on-a-field-with-multiple-words/m-p/50293#M12086 <P>Great, it works <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 04 Mar 2013 19:06:08 GMT https://community.splunk.com/t5/Splunk-Search/Eval-command-on-a-field-with-multiple-words/m-p/50293#M12086 cmak 2013-03-04T19:06:08Z https://community.splunk.com/t5/Splunk-Search/Eval-command-on-a-field-with-multiple-words/m-p/50294#M12087 <P>Another way is to use single quotes for field names with difficult characters:</P> <PRE><CODE>eval newfield='My Old Field' </CODE></PRE> <P>Note that this works in eval and where clauses, but quoting in search commands in general is inconsistent.</P> Mon, 04 Mar 2013 19:41:10 GMT https://community.splunk.com/t5/Splunk-Search/Eval-command-on-a-field-with-multiple-words/m-p/50294#M12087 gkanapathy 2013-03-04T19:41:10Z https://community.splunk.com/t5/Splunk-Search/Eval-command-on-a-field-with-multiple-words/m-p/50295#M12088 <P>Great, this works for advanced XML dashboards</P> Mon, 04 Mar 2013 23:16:06 GMT https://community.splunk.com/t5/Splunk-Search/Eval-command-on-a-field-with-multiple-words/m-p/50295#M12088 cmak 2013-03-04T23:16:06Z