topic Re: Eval function on a column that has spaces in Splunk Search

Eval function on a column that has spaces

ttanasovski — Fri, 27 Jul 2012 13:40:58 GMT

Table blah, “has a space” |eval tonumber(“has a space”)/2

Do you know a way to do the above that works? In the above, it treats “has a space” as a string rather than the data in the column. My workaround is:

table blah, "has a space"|rename “has a space” as blah2|eval tonumber(blah2)/2|rename blah2 “has a space”

There has to be an easier way.

Re: Eval function on a column that has spaces

Kate_Lawrence-G — Fri, 27 Jul 2012 20:30:45 GMT

I would add a field extraction to pull out just the number from either the field or _raw data. If you pull out just a number into a field then Splunk will treat it as a number and you can perform functions on it.

Re: Eval function on a column that has spaces

ttanasovski — Sun, 29 Jul 2012 20:51:37 GMT

So looking at my actual problem, it still stands. The tonumber is a bit of a red herring. I didn't actually need to use tonumber. The problem is that I want to use anything in eval with spaces. This is an extract, but the column name has a space in it.

table blah, "has a space"|rename “has a space” as blah2|eval blah2/2|rename blah2 “has a space”

If I try to do the following, I get an error:
table blah, "has a space" |eval "has a space"/2

How can I do the above without the rename?

Re: Eval function on a column that has spaces

sowings — Mon, 30 Jul 2012 12:39:39 GMT

My experience has been that you'll need the rename.

Re: Eval function on a column that has spaces

dmaislin_splunk — Mon, 30 Jul 2012 12:43:46 GMT

Just do field extractions without spaces in the field names.

Re: Eval function on a column that has spaces

sideview — Sat, 02 Mar 2013 01:11:17 GMT

I have found a place where I need this, where the eval statement is happening in something automated. I tried the {} trick and it didn't work sadly. Namely --- given a field foo whose value is "fooValue", | eval {foo}=12 will create a field called fooValue whose value is 12. Not super widely known, but quite useful.

At any rate, from this you might hope that {"my field name has spaces"} would work in eval as a syntax to get around the problem, but sadly it doesn't. There's no error which is odd, but it doesn't end up referencing the field name with the spaces.

Re: Eval function on a column that has spaces

jda258 — Tue, 23 Dec 2014 20:13:25 GMT

I found the answer here: http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Eval

You have to use single quotes instead of double quotes when referencing fields inside of eval functions:

Table blah, “has a space” |eval tonumber('has a space')/2

Re: Eval function on a column that has spaces

jda258 — Tue, 23 Dec 2014 20:15:03 GMT

Also tricky is when assigning a result to a field as you need double quotes:

eval "field with spaces"=round('field with spaces')