topic Re: How do you use multi value tags in eval? in Splunk Search

How do you use multi value tags in eval?

Marinus — Tue, 07 Jun 2011 09:34:36 GMT

I getting an eval error when I'm trying to use eval on a host tag.
"Error in 'eval' command: The expression is malformed. Expected )"

Most hosts have more than on tag.

* | eval nr_tags=eval(mvcount(tag::host))

Re: How do you use multi value tags in eval?

msenebald — Wed, 19 Jun 2013 09:52:45 GMT

Hi I have a similar problem.

the thing is even with

* | eval nr_tags=mvcount("tag::host")

you will always get 1 in nr_tags. it takes this as a string.

I would like to do something like this:

| eval iscool=if("tag::host" == "cool", "yes" , "no")

where host=fridge with tags: cool, fridge, ..

So actually i want to have a field in case a certain tag is applied to this event.
But i strugle to identify this in the tag::host field. mvcount and so always sees "tag::host" as a string, not as the field

Any Ideas?

Re: How do you use multi value tags in eval?

bob_kerns — Sat, 06 Sep 2014 23:33:44 GMT

Very belated answer, but helpful for those who may end up here by search...

Instead of "tag::host", try single quote:
* | eval nr_tags=mvcount('tag::host')

Try this and compare the results. Set up more than one tag on at least one host so you can compare:

* | eval foo="tag::host"
   | tags outputfield=bar host
   | eval bar2='tag::host'
   | eval baz=mvcount("tag::host")
   | eval buz=mvcount('tag::host')

Re: How do you use multi value tags in eval?

bob_kerns — Sun, 07 Sep 2014 00:19:22 GMT

Note, however, that this won't work in a computed field, since tagging happens after field extraction (including computed fields).