topic Re: Can't use eval function on fields extracted from json log using spath in Splunk Search

Can't use eval function on fields extracted from json log using spath

myobmatt — Tue, 13 Mar 2018 09:07:54 GMT

I have extracted fields from a json log using spath, I want to add double quotes to the tabled results using ... | eval myval="\"".myval."\"" but no eval function seems to work on the fields extracted in this way. What am I doing wrong??

Re: Can't use eval function on fields extracted from json log using spath

493669 — Tue, 13 Mar 2018 10:16:15 GMT

Hi
have you tried this:

|eval myval="\"".myval."\""

Re: Can't use eval function on fields extracted from json log using spath

tiagofbmm — Tue, 13 Mar 2018 10:17:17 GMT

You jus need one set of \" in the beginning and one in the end, like this

| eval myval="\""+myval+"\""

Re: Can't use eval function on fields extracted from json log using spath

myobmatt — Tue, 13 Mar 2018 10:37:10 GMT

Any field that I have extracted from the json log using spath, when I try to apply ANY eval function, comes up blank when I try to table it

Re: Can't use eval function on fields extracted from json log using spath

niketn — Tue, 13 Mar 2018 10:48:24 GMT

@myobmatt can you add some JSON data sample along with the field name that spath extracts?

Re: Can't use eval function on fields extracted from json log using spath

tiagofbmm — Wed, 21 Mar 2018 17:03:09 GMT

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that