topic When using "typeof, results are field value invalid in Splunk Search

When using "typeof, results are field value invalid

vsid_splunk — Tue, 12 Jul 2022 13:27:34 GMT

I have used "typeof" to know the Types for fields for the data set in splunk web version, but I get the Value column showing invalid in each one of its corresponding rows.

Re: field value invalid

vsid_splunk — Fri, 07 Nov 2014 17:24:58 GMT

Can anyone "Please" Respond using #Tag. ASAP!

Re: field value invalid

somesoni2 — Fri, 07 Nov 2014 18:41:31 GMT

Can you post your search?

Re: field value invalid

vsid_splunk — Fri, 07 Nov 2014 20:19:10 GMT

sourcetype = json | FieldsTypes

This macro definition of FieldsTypes is.... eval Ent_Code = typeof ('TableEntry.EventCode')

So @somesoni2 , im seeing the Ent_Code as invalid in "value" column after I click on "AllFields"

Re: field value invalid

vsid_splunk — Mon, 10 Nov 2014 14:56:10 GMT

@somesoni2 can you look at my search, sir?

Re: field value invalid

Raghav2384 — Mon, 10 Nov 2014 15:32:23 GMT

Never used typeof / didn't get there yet. May be this can help
http://answers.splunk.com/answers/177400/how-to-use-json-extracted-fields-with-eval-functio.html

Re: field value invalid

cdstealer — Thu, 26 Jul 2018 10:28:06 GMT

just ran into this myself. single quotes fixed it. Thanks

Re: field value invalid

top_splunker — Tue, 12 Jul 2022 13:02:46 GMT

@vsid_splunk try putting single quotes around the field name that is returning as invalid.

Re: field value invalid

makelovenotwar — Thu, 13 Jul 2023 15:49:52 GMT

GENIUS!