topic Re: Splunk query Help in Splunk Search

Help adding pipe "l" for all results

kc_prane — Tue, 30 Aug 2022 22:52:29 GMT

Hello - I am getting the below error. I am trying to add pipe "|" for all the results.

Error : Failed to parse templatized search for field 'ResponseTime(ms)'

My search :

| table PeriodDate VendorName ContractName OccMetricCode Pagekey TransactionType TransactionDatetime ResponseTime(ms) Comment
| foreach * [ eval <<FIELD>>="|".<<FIELD>>."|"]

I am not getting pipe seperated results only for ResponseTime

PeriodDate	ResponseTime(ms)	Comment
\|2022/08/30\|	0	\|\|

Thanks in advance

Re: Splunk query Help

ITWhisperer — Tue, 30 Aug 2022 21:18:27 GMT

Try something like this

| table PeriodDate VendorName ContractName OccMetricCode Pagekey TransactionType TransactionDatetime ResponseTime(ms) Comment | foreach * [ eval "<<FIELD>>"="|".'<<FIELD>>'."|"]

Re: Help adding pipe "l" for all results

bowesmana — Tue, 30 Aug 2022 23:23:15 GMT

To add to @ITWhisperer reply. When handling field names that start with numbers, or contain 'odd' characters, e. g. in this case the brackets, (), you need to use single quote characters on the right hand side of eval. It's always sensible, particularly when using foreach, to DOUBLE quote the left hand side of the eval, i.e.

| eval "QUOTED NAME"='Quoted(ms) field'

Re: Splunk query Help

kc_prane — Wed, 21 Sep 2022 22:41:17 GMT

Thanks @ITWhisperer