Why am I yielding an error with Where Statement for exact numeric value?

blablabla — Wed, 20 Jul 2022 14:01:53 GMT

Hello,

I am experiencing an interesting Issue. I am trying to filter for a specific value in a numeric field. Following statement works finde:

index="IndexA" | eval A.distance=trim('A.distance',"'") | eval A.distance='A.distance'/100 | search A.distance=1

If I am trying to replace the search with a where, I am getting the Error "Error in 'where' command: Type checking failed. The '==' operator received different types."

index="IndexA" | eval A.distance=trim('A.distance',"'") | eval A.distance='A.distance'/100 | where A.distance=1

Event Coverage if this value is 100% and all the values get for typeof() the result "Number". All of the values do not have a digit after the comma. We are using Splunk Enterprise 8.2.3.3 . Does someone know, why the where statement is yielding an error in this case?

Thanks

Re: Where Statement for exact numeric value

ITWhisperer — Wed, 20 Jul 2022 08:14:22 GMT

Try not to have special characters in field names - if you want to continue with them, put the field name in single quotes

| where 'A.distance'=1

topic Re: Where Statement for exact numeric value in Splunk Search

Why am I yielding an error with Where Statement for exact numeric value?

Re: Where Statement for exact numeric value