Search on data model object, weird behavior

MemoreX42 — Thu, 24 Apr 2014 16:53:47 GMT

Hi guys,

i'm fairly new to Splunk and have a problem regarding searches on data models.
So what i did is, i created a data model which introduces a new field to my events by an evaluation. Now i'm trying to search on this data and create reports.
So what i'm doing in my searches looks like this:

| datamodel Probe CityProbe search | stats values(Probe.Class)

Where "Class" is a field of type number in the events of my data object. This works fine and it produces the different values that are in "Class".
Now i'm trying to execute some if statements on this "Class" field, so i do something like the following:

| datamodel Probe CityProbe search | eval n = if(Probe.Class==1, "true", "false") | stats values(n)

This fails with "Error in 'eval' command: Typechecking failed. The '==' operator received different types.". So i tried to find out of what type the "Probe.Class" field is and it turns out that it is NULL all the time. I don't get how this can be, since the first query, working on the same field, works.

By the way, when i do this on the index itself, without the data model, it works.

Can anyone please enlighten me on how this works?
Thanks in advance

Regards, Karsten

Re: Search on data model object, weird behavior

tpflicke — Tue, 24 Mar 2015 11:58:54 GMT

I had the same message and resolved it by single-quoting the fields inside the eval statement so the following might do the trick:

... | eval n = if('Probe.Class'==1, "true", "false") | ...

Re: Search on data model object, weird behavior

anchalsingh — Thu, 06 Apr 2017 08:38:56 GMT

Use single quote around the field to resolve error as mentioned in the comment.

... | eval n = if('Probe.Class'==1, "true", "false") | ...

I got my issue resolved using this.

topic Re: Search on data model object, weird behavior in Splunk Search

Search on data model object, weird behavior

Re: Search on data model object, weird behavior

Re: Search on data model object, weird behavior