topic Re: Funkyness with Eval in Splunk Search

Funkyness with Eval

tmarlette — Wed, 05 Mar 2014 20:46:23 GMT

SO I am using an EVAL command in one of my searches in order to name process state as "OK" or "DOWN". This is my Query:

 sourcetype=WMI:Service Name=VMTools | dedup host,Name | eval State = if(State == Running, "OK","DOWN") | table _time,host,Name,State

When I do I get the process is down, even if it's running. Please take a look at the image:

Now when I remove the "EVAL" Statement in the query above, it looks just fine. This is the query I am using:

sourcetype=WMI:Service Name=VMTools | dedup host,Name | table _time,host,Name,State

This is the image for the results no less than 1 minute after the previous image:

I am just wondering if I am doing something wrong? I checked the documentation, but I haven't seen this behavior before. I've been looking at this for awhile, and I'm wondering if there is a simple syntax error i'm overlooking?

Re: Funkyness with Eval

tmarlette — Wed, 05 Mar 2014 20:49:54 GMT

Running a search on every service on that machine WITH the EVAL statement, it shows every service as "DOWN".

Re: Funkyness with Eval

aelliott — Wed, 05 Mar 2014 20:51:34 GMT

perhaps quotation marks around "Running"?
It may be looking for the field named Running.

Re: Funkyness with Eval

tmarlette — Wed, 05 Mar 2014 20:59:41 GMT

Oh... My... God..... I feel completely inadequate. Thank you very much sir!

so long... everything looks the same!!