https://community.splunk.com/t5/Splunk-Search/sub-search-does-not-return-string-on-splunk-8-1-4/m-p/582734#M202946 <P>Wow! Thank you very much for quick and perfect answer! It works fine!</P> Thu, 27 Jan 2022 12:00:18 GMT kiyoshi_miyake 2022-01-27T12:00:18Z https://community.splunk.com/t5/Splunk-Search/sub-search-does-not-return-string-on-splunk-8-1-4/m-p/582709#M202942 <P>I get number from subsearch but get null for string like below on splunk 8.1.4.<BR />I found the splunk answer that resolved by appending "format", but it is not resolved for me. Is it bug on 8.x?</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="subsearch_issue.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/17711i54ED42E89A7D12E9/image-size/large?v=v2&amp;px=999" role="button" title="subsearch_issue.PNG" alt="subsearch_issue.PNG" /></span><BR /><BR />| makeresults<BR />| eval foo = [ | makeresults | eval foo="123" | return $foo ]<BR />| eval bar = [ | makeresults | eval bar="bar" | return $bar ]<BR />| eval baz = tostring([ | makeresults | eval baz="baz" | return $baz ])<BR />| eval qux = tostring([ | makeresults | eval qux="qux" | return $qux | format ])<BR />| table _time foo bar baz qux</P> Thu, 27 Jan 2022 09:51:34 GMT https://community.splunk.com/t5/Splunk-Search/sub-search-does-not-return-string-on-splunk-8-1-4/m-p/582709#M202942 kiyoshi_miyake 2022-01-27T09:51:34Z https://community.splunk.com/t5/Splunk-Search/sub-search-does-not-return-string-on-splunk-8-1-4/m-p/582722#M202945 <P>If you expand the query (&lt;ctrl&gt;&lt;shift&gt;E) you get this</P><LI-CODE lang="markup">| makeresults | eval foo = 123 | eval bar = bar | eval baz = tostring( baz ) | eval qux = tostring( ( ( qux ) ) ) | table _time foo bar baz qux</LI-CODE><P>Which explains all the null and empty fields</P><P>You can (almost) fix this by providing arguments to the format command - the result (if not numeric) still needs trimming</P><LI-CODE lang="markup">| makeresults | eval foo = [ | makeresults | eval foo="123" | return $foo ] | eval bar = trim([ | makeresults | eval bar="bar" | return $bar | format "\"" "" "" "" "" "\"" ]) | eval baz = tostring(trim([ | makeresults | eval baz="baz" | return $baz | format "\"" "" "" "" "" "\"" ])) | eval qux = tostring(trim([ | makeresults | eval qux="qux" | return $qux | format "" "\"" "" "\"" "" "" ])) | table _time foo bar baz qux</LI-CODE><P>Giving</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ITWhisperer_0-1643280109814.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/17714iA6CEA43045BB760B/image-size/medium?v=v2&amp;px=400" role="button" title="ITWhisperer_0-1643280109814.png" alt="ITWhisperer_0-1643280109814.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="ITWhisperer_1-1643280151197.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/17715iCF6C74249953A006/image-size/medium?v=v2&amp;px=400" role="button" title="ITWhisperer_1-1643280151197.png" alt="ITWhisperer_1-1643280151197.png" /></span></P><P>&nbsp;</P> Thu, 27 Jan 2022 10:42:41 GMT https://community.splunk.com/t5/Splunk-Search/sub-search-does-not-return-string-on-splunk-8-1-4/m-p/582722#M202945 ITWhisperer 2022-01-27T10:42:41Z https://community.splunk.com/t5/Splunk-Search/sub-search-does-not-return-string-on-splunk-8-1-4/m-p/582734#M202946 <P>Wow! Thank you very much for quick and perfect answer! It works fine!</P> Thu, 27 Jan 2022 12:00:18 GMT https://community.splunk.com/t5/Splunk-Search/sub-search-does-not-return-string-on-splunk-8-1-4/m-p/582734#M202946 kiyoshi_miyake 2022-01-27T12:00:18Z