topic Re: How to query multiple conditions when the field name has a space in Splunk Search

How to query multiple conditions when the field name has a space

vjverma — Fri, 18 Jul 2014 22:41:54 GMT

I need to run a query on the following lines:

index=i source=s earliest=-7W@W latest=@W | timechart span=1w count AS Overall count(eval(field1>0 )) AS F1Count count(eval("Field 2">0)) AS F2Count

The "Field 2" results in a syntax error saying "The eval expression for dynamic field '"Field 2">0' is invalid"

I can't rename the "Field 2". Is they any other way to query this data.

I could do
index=i source=s earliest=-7W@W latest=@W "Field 2">0| timechart span=1w count AS F2Count

but this requires me to run this query multiple times for each field.

Re: How to query multiple conditions when the field name has a space

martin_mueller — Fri, 18 Jul 2014 23:08:13 GMT

Of course you can rename Field 2:

index=i source=s earliest=-7W@W latest=@W | rename "Field 2" as Field_2 | timechart span=1w count AS Overall count(eval(field1>0 )) AS F1Count count(eval(Field_2>0)) AS F2Count

Alternatively you can use single quotes in eval:

index=i source=s earliest=-7W@W latest=@W | timechart span=1w count AS Overall count(eval(field1>0 )) AS F1Count count(eval('Field 2'>0)) AS F2Count

Double quotes would make that a string that can't be compared with a number, causing that error.

Re: How to query multiple conditions when the field name has a space

vjverma — Sat, 19 Jul 2014 02:18:15 GMT

Thank you. Worked like a charm.