https://community.splunk.com/t5/Splunk-Search/Using-rest-with-eval/m-p/153949#M43245 <P>Hello,</P> <P>is there a possibility to use the |rest command with an eval like:</P> <P><CODE>anysearch</CODE><BR /> |eval test = [rest /services/authentication/current-context <BR /> |rename username as user|return $user]</P> <P>With this search I just get an empty field test. But why?<BR /> Greetings</P> Wed, 23 Jul 2014 12:28:47 GMT C_Sparn 2014-07-23T12:28:47Z https://community.splunk.com/t5/Splunk-Search/Using-rest-with-eval/m-p/153949#M43245 <P>Hello,</P> <P>is there a possibility to use the |rest command with an eval like:</P> <P><CODE>anysearch</CODE><BR /> |eval test = [rest /services/authentication/current-context <BR /> |rename username as user|return $user]</P> <P>With this search I just get an empty field test. But why?<BR /> Greetings</P> Wed, 23 Jul 2014 12:28:47 GMT https://community.splunk.com/t5/Splunk-Search/Using-rest-with-eval/m-p/153949#M43245 C_Sparn 2014-07-23T12:28:47Z https://community.splunk.com/t5/Splunk-Search/Using-rest-with-eval/m-p/153950#M43246 <P>Use it like this (run anywhere code). You're extracting string and its need to be within double quotes for eval to work.</P> <PRE><CODE>|stats count |eval test = [|rest /services/authentication/current-context |eval user="\"".username."\""|return $user] </CODE></PRE> Wed, 23 Jul 2014 12:36:16 GMT https://community.splunk.com/t5/Splunk-Search/Using-rest-with-eval/m-p/153950#M43246 somesoni2 2014-07-23T12:36:16Z https://community.splunk.com/t5/Splunk-Search/Using-rest-with-eval/m-p/153951#M43247 <P>WOW!<BR /> Thank you very much. That solved the problem.<BR /> Another possibility is to use: <BR /> "+" instead of "." in the eval<BR /> Greetings</P> Wed, 23 Jul 2014 12:43:23 GMT https://community.splunk.com/t5/Splunk-Search/Using-rest-with-eval/m-p/153951#M43247 C_Sparn 2014-07-23T12:43:23Z