topic Foreach fails if field contains colon or dot. in Splunk Search

Foreach fails if field contains colon or dot.

iet_ashish — Sun, 26 Apr 2020 20:52:58 GMT

On running this search,

  | makeresults count=20
    | streamstats count
    | eval "genie.name"="foo", "genie:id"="bar"
    | foreach genie* 
        [eval new_<<MATCHSTR>>=<<FIELD>>+"some string"]

I am expecting that two new fields named new_name and new_id would show, but that doesn't happen. Also an error comes up Failed to parse templatized search for field 'genie:id'

I am running on my local Splunk instance.

Thanks.

Re: Foreach fails if field contains colon or dot.

martin_mueller — Sun, 26 Apr 2020 20:58:30 GMT

It's not foreach that's failing, it's eval interpreting the dot as the concatenation operator. Enclose field names with operators in them in single quotes:

| foreach genie* [ eval new_<<MATCHSTR>> = '<<FIELD>>' + "some string" ]

Re: Foreach fails if field contains colon or dot.

iet_ashish — Mon, 27 Apr 2020 06:26:27 GMT

Thank you so much. This worked.