topic eval fails if fields have a ":" in their name in Splunk Search

eval fails if fields have a ":" in their name

bnolen — Fri, 15 Oct 2010 07:26:49 GMT

I have some data in the form of xml records. The fields extract fine using the xmlkv operator, but I can not perform coaelese or similar eval functions because of the ":" in the name of the key fields I am interested in:

source data example:

<c:ResponseHeader>
<c:StatusOk>true</c:StatusOk>
<c:StatusMessage/>
</c:ResponseHeader>
<c:AdminContractId>123456</c:AdminContractId>

search command I would like to use

| xmlkv |eval ctxid=coalesce(c:AdminContractId, contract:AdminContractId)

fails with error

Error in 'eval' command: The expression is malformed. Expected ).

even a simpler standalone example

| eval myExample=an:example

fails with

Error in 'eval' command: The operator at ':example' is invalid.

Re: eval fails if fields have a ":" in their name

Genti — Fri, 15 Oct 2010 08:05:45 GMT

are you sure you get the same error for | eval example=an:example?
i believe it should actually be "Error in 'eval' command: The operator at ':example' is invalid.

It seems to me that this is just not accepted. Fix your fileds is what i would say.

Here is an example i made up:

* | head 2000 | eval x:y=linecount | eval z=x:y

the first eval works just fine, and a new field called x:y gets created, however the second eval, breaks. Again, i believe its normal behavior, but we could possibly ask our Dev's and find out for sure..

as a workaround try:

* | head 2000 | eval x:y=linecount | eval z="x:y"

note the ""
Cheerio,
.gz

Re: eval fails if fields have a ":" in their name

bnolen — Fri, 15 Oct 2010 08:12:07 GMT

op updated to reflect actual error from the "cooked" example

Re: eval fails if fields have a ":" in their name

bnolen — Fri, 15 Oct 2010 08:50:24 GMT

I have found a hack type workaround - perform a sed before the xmlkv:

rex field=_raw mode=sed "s/\:/_/g"

Re: eval fails if fields have a ":" in their name

bnolen — Sat, 16 Oct 2010 19:11:39 GMT

Your solution of encasing the RHS of the equals sign in quotation marks means that it is treated as a string, thus Z will always equal the literal string "x:y" and not the value of variable x:y

Nice idea though, but tried that already, as well as trying to "escape" and colon with a backslash... also no joy.

Re: eval fails if fields have a ":" in their name

bfernandez — Tue, 27 Nov 2012 10:54:11 GMT

You should wrap the fieldname name with '$'

For example:
| eval myExample=$an:example$