https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111700#M29272 <P>I don't think it's possible. The closest I got was using the "map" command, which is basically a looping, "for each result do that...". Have a look on the documentation, might be useful for you.</P> Tue, 09 Sep 2014 00:40:33 GMT musskopf 2014-09-09T00:40:33Z https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111689#M29261 <P>Hi<BR /> I try to return a string value and does not recognize, and when return a numeric value if recognized. No way to return the string?<BR /> My Search is:</P> <PRE><CODE> host=IMG6460B sourcetype="WinEventLog:Application" | eval UserSession=[ search host=IMG6460B sourcetype="WinEventLog:System" | head 1 | return $Session] </CODE></PRE> <P>But does not return a value, the return value is Session="a0291da-2039"</P> Thu, 04 Sep 2014 15:13:51 GMT https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111689#M29261 jrodriguezap 2014-09-04T15:13:51Z https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111690#M29262 <P>With the "$" sign in front, your return value should be a0291da-2039. But i think this is not working with the eval. Not sure if this is the answer, but can you try this:</P> <PRE><CODE>host=IMG6460B sourcetype="WinEventLog:Application" | eval UserSession=[ search host=IMG6460B sourcetype="WinEventLog:System" | head 1 | eval temp_session="\"".Session."\"" | return $temp_session] </CODE></PRE> Thu, 04 Sep 2014 15:38:41 GMT https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111690#M29262 tom_frotscher 2014-09-04T15:38:41Z https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111691#M29263 <P>Thanks tom_frotscher<BR /> I gave the eval, but nothing, not to return the string value, only numeric, is that normal?</P> Thu, 04 Sep 2014 15:44:38 GMT https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111691#M29263 jrodriguezap 2014-09-04T15:44:38Z https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111692#M29264 <P>That's weird: @tom_frotscher's solution totally worked for me.</P> <P>(As an aside - you can leave out the <CODE>head 1</CODE> clause in the subsearch - by using the <CODE>return</CODE> function the <CODE>head 1</CODE> is implied.)</P> <P>I agree, it seems strange that you have to do the additional <CODE>eval</CODE> processing to get it to work with string values being returned, but it does seem to work correctly.</P> Thu, 04 Sep 2014 15:55:59 GMT https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111692#M29264 aweitzman 2014-09-04T15:55:59Z https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111693#M29265 <P>for returning multiple values use makemv and then return the whole value then divide the multivalued field.</P> Thu, 04 Sep 2014 16:07:37 GMT https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111693#M29265 linu1988 2014-09-04T16:07:37Z https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111694#M29266 <P>I tried it with another indexer, and I like it. <BR /> When I run only </P> <PRE><CODE>search host=IMG6460B sourcetype="WinEventLog:System" | head 1 | eval temp_session="\"".Session."\"" | return $temp_session </CODE></PRE> <P>I returns the value </P> <PRE><CODE>**temp_session** a0291da-2039 </CODE></PRE> <P>but when I run it with Eval, the field UserSession does not get the value <BR /> If it's weird.</P> Thu, 04 Sep 2014 16:15:13 GMT https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111694#M29266 jrodriguezap 2014-09-04T16:15:13Z https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111695#M29267 <P>Hi<BR /> someone will this ever happened? or be a bug report should support? <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Thu, 04 Sep 2014 20:24:45 GMT https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111695#M29267 jrodriguezap 2014-09-04T20:24:45Z https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111696#M29268 <P>Seems to be a bug, the workaround is to add the quotes as you did, it worked for me:</P> <P><CODE>index=main | eval test=[ search index=other_index | head 1 | eval fieldA="\""+fieldA+"\"" | return $fieldA]</CODE></P> Fri, 05 Sep 2014 00:04:39 GMT https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111696#M29268 musskopf 2014-09-05T00:04:39Z https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111697#M29269 <P>It is true musskopf. <BR /> I had not realized that the quotes were needed. @tom_frotscher's was quite right. <BR /> Sorry and thank you very much</P> Fri, 05 Sep 2014 04:04:36 GMT https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111697#M29269 jrodriguezap 2014-09-05T04:04:36Z https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111698#M29270 <P>A question please. <BR /> You can send a parameter from the main search to return search? <BR /> I need to put a condition to return value, something like this:</P> <PRE><CODE>index=main field_MAIN=val1 | eval test=[ search index=other_index | where field_SUB=field_MAIN | head 1 | eval fieldA="\""+fieldA+"\"" | return $fieldA] </CODE></PRE> Fri, 05 Sep 2014 05:22:53 GMT https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111698#M29270 jrodriguezap 2014-09-05T05:22:53Z https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111699#M29271 <P>is this possible? or any other way?</P> Mon, 08 Sep 2014 16:43:30 GMT https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111699#M29271 jrodriguezap 2014-09-08T16:43:30Z https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111700#M29272 <P>I don't think it's possible. The closest I got was using the "map" command, which is basically a looping, "for each result do that...". Have a look on the documentation, might be useful for you.</P> Tue, 09 Sep 2014 00:40:33 GMT https://community.splunk.com/t5/Splunk-Search/return-command-works-only-with-numeric-values/m-p/111700#M29272 musskopf 2014-09-09T00:40:33Z