topic Re: How do I match a field to a variable? in Splunk Search

How do I match a field to a variable?

kkatzgraukeyw — Fri, 23 Oct 2015 13:46:19 GMT

I've got a query that will have a string passed into it. In this case, it's "2-Low". I need to parse out the number and match that to rows with a field called 'score' containing the same value.

Strangely enough, this query isn't returning results (there is definitely matching data):

index=someindex | parser | eval ar = split("2-Low","-") | eval tl = mvindex(ar, 0) | search score = tl

As a sanity check, if I try this to make sure the string manipulation worked, I get the number "2" as expected.

index=someindex | parser | eval ar = split("2-Low","-") | eval tl = mvindex(ar, 0) | fields tl

Any thoughts on what I might not be doing correctly?

Re: How do I match a field to a variable?

woodcock — Fri, 23 Oct 2015 14:33:34 GMT

The problem is that you are using search instead of where. The search command ALWAYS understands the Right-Hand-Value to be a string-literal whereas where presumes the RHV to be a fieldname and switches to treating it as a string-literal only if you force it to, such as by enclosing it in double-quotes.

Re: How do I match a field to a variable?

kkatzgraukeyw — Fri, 23 Oct 2015 17:08:55 GMT

Perfect. Thanks for the explanation!

Re: How do I match a field to a variable?

woodcock — Sat, 24 Oct 2015 14:56:41 GMT

You should click "Accept" to close out the question.

Re: How do I match a field to a variable?

martin_mueller — Sat, 05 Dec 2015 14:40:07 GMT

where does NOT switch to treating a fieldname as a string literal if that field does not exist. Doing so would be terrible. Example:

| stats count | eval field = "foo" | where field = "foo"
| stats count | eval field = "foo" | where field = foo

By your reasoning, both searches should keep the one event generated by the stats. However, the field foo does not exist, hence it's comparing field to null() yielding false and dropping the event. This is the only sane behaviour imaginable.

Additionally, I would recommend against enclosing RHS fields in dollar signs because that would break when included in dashboards - those would then treat the dollar-sign-fieldname as a form token. Instead, enclose the field name in single quotes as documented here: http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Eval#Required_arguments

Re: How do I match a field to a variable?

woodcock — Sat, 05 Dec 2015 17:09:19 GMT

You are correct, I have adjusted my answer to reflect the more correct nuance.