topic Re: How to reference a Field Name containing "()" without breaking the search or stats? in Splunk Search

How to reference a Field Name containing "()" without breaking the search or stats?

leonardr — Mon, 28 Sep 2015 20:43:57 GMT

I have a field name that contains "(rpm)" and cannot find a way to reference it without it breaking a search or stats. What can I do to escape or otherwise reference the field?

Bob

Re: How to reference a Field Name containing "()" without breaking the search or stats?

masonmorales — Mon, 28 Sep 2015 20:48:18 GMT

Have you tried single quotes? 'fieldname'

Another option is to use either a field alias (in props.conf or in Splunk Web on the Search Head via Settings -> Fields -> Field alias), or a rename in your search before doing stats, eval, etc.

Re: How to reference a Field Name containing "()" without breaking the search or stats?

masonmorales — Mon, 28 Sep 2015 20:49:44 GMT

Also, if it's in the sidebar, click on it, select a value (to add it to your search) and see how Splunk references it.

Re: How to reference a Field Name containing "()" without breaking the search or stats?

lguinn2 — Mon, 28 Sep 2015 20:51:29 GMT

Have you tried the rename command?

... | rename "xyz (rpm)" as xyz_rpm | ...

I know you probably didn't create the field name this way, but FYI:

Field names that are made from the following character set will never require quotation marks and will be properly understood by all Splunk commands:

Upper case letters (A-Z)
Lower case letters (a-z)
Digits (0-9)
Underscore (_)

Field names should begin with a letter.

Re: How to reference a Field Name containing "()" without breaking the search or stats?

somesoni2 — Mon, 28 Sep 2015 22:13:07 GMT

Within transforming commands (eval, stats, timechart etc) and WHERE command, use the field within single quote 'YourField(ABC)'

For other places (table, fields, search) put it within double quotes.

Re: How to reference a Field Name containing "()" without breaking the search or stats?

woodcock — Tue, 29 Sep 2015 03:38:18 GMT

You can enclose field names within dollar signs like this:

... | eval xyz_rpm = $xyz (rpm)$

Re: How to reference a Field Name containing "()" without breaking the search or stats?

lguinn2 — Tue, 29 Sep 2015 06:48:29 GMT

Field alias is also available from the GUI: Go to Settings -> Fields -> Field alias