topic Re: return function on field with spaces in Splunk Search

return function on field with spaces

kwanx — Tue, 29 Aug 2017 17:55:16 GMT

Hello - searched, but no answer found.

...| return 10 "Name of Field"

Gives:
Name="" of="" Field=""

I know that I can rename this field, but the goal is to get the actual correct name with spaces as it is used in another sourcetype with the same format.

Any ideas please?

Re: return function on field with spaces

richgalloway — Tue, 29 Aug 2017 18:34:04 GMT

Have you tried using single quotes around the field name?

Re: return function on field with spaces

kwanx — Tue, 29 Aug 2017 19:05:55 GMT

yes, simiar results 😕

Re: return function on field with spaces

somesoni2 — Tue, 29 Aug 2017 20:00:21 GMT

Not sure if it's a bug/limitation/design, but return command only accepts fields with clean names (no spaces). The workaround would be like this

...| head 10 | table "Name of Field" | format

Re: return function on field with spaces

kwanx — Tue, 29 Aug 2017 20:18:43 GMT

maybe so; that yields:

( ( "Name=\"\" of=\"\" Field=\"\"" ) )

Re: return function on field with spaces

somesoni2 — Tue, 29 Aug 2017 20:36:01 GMT

Try this runanywhere search.

| gentimes start=-10 | eval "Name of field"=starttime | table "Name of field" | format

output:

( ( "Name of field"="1503118800" ) OR ( "Name of field"="1503205200" ) OR ( "Name of field"="1503291600" ) OR ( "Name of field"="1503378000" ) OR ( "Name of field"="1503464400" ) OR ( "Name of field"="1503550800" ) OR ( "Name of field"="1503637200" ) OR ( "Name of field"="1503723600" ) OR ( "Name of field"="1503810000" ) OR ( "Name of field"="1503896400" ) )

Re: return function on field with spaces

woodcock — Wed, 30 Aug 2017 02:31:59 GMT

I do not believe that this can be; even so, it would be best if you didn't.

Best Practice: Do not use field names with spaces.
Even Better Practice: Only use "clean" names:
http://docs.splunk.com/Documentation/Splunk/latest/Admin/Transformsconf#Clean_keys

Re: return function on field with spaces

niketn — Wed, 30 Aug 2017 06:48:24 GMT

@kwanx, what is your use case? What are you trying to do? It would be possible for us to suggest alternative if you can share complete SPL.

Re: return function on field with spaces

fbehe — Wed, 30 Aug 2017 08:19:44 GMT

As already said by previous comments, correct solution would be to use spaceless names, but if you cannot change the field name, one workaround would be to add a rename command before the return

Instead of having

... | return 10 "Name of Field"

You would have

... | rename "Name of Field" as foo | return 10 foo

Re: return function on field with spaces

tchintam — Thu, 07 Jun 2018 15:36:32 GMT

Can I pass that 10 from a count? I mean say suppose I have this command stats count as count which gives me 10. How I do write the return query->

|return count foo