https://community.splunk.com/t5/Splunk-Search/eval-command/m-p/291699#M88115 <P>Ok I'm feeling kinda stupid</P> <P>this query works</P> <PRE><CODE>index=wholesale_app buildTarget=comcast analyticType=SessionStart |eval hardwaretype=Properties.platformData.HC|stats count by Properties.platformData.HC </CODE></PRE> <P>but this one dosen't</P> <PRE><CODE>index=wholesale_app buildTarget=comcast analyticType=SessionStart |eval hardwaretype=Properties.platformData.HC|stats count by hardwaretype </CODE></PRE> <P>Scratches head ------ what am I missing?</P> Mon, 20 Nov 2017 23:52:43 GMT dbcase 2017-11-20T23:52:43Z https://community.splunk.com/t5/Splunk-Search/eval-command/m-p/291699#M88115 <P>Ok I'm feeling kinda stupid</P> <P>this query works</P> <PRE><CODE>index=wholesale_app buildTarget=comcast analyticType=SessionStart |eval hardwaretype=Properties.platformData.HC|stats count by Properties.platformData.HC </CODE></PRE> <P>but this one dosen't</P> <PRE><CODE>index=wholesale_app buildTarget=comcast analyticType=SessionStart |eval hardwaretype=Properties.platformData.HC|stats count by hardwaretype </CODE></PRE> <P>Scratches head ------ what am I missing?</P> Mon, 20 Nov 2017 23:52:43 GMT https://community.splunk.com/t5/Splunk-Search/eval-command/m-p/291699#M88115 dbcase 2017-11-20T23:52:43Z https://community.splunk.com/t5/Splunk-Search/eval-command/m-p/291700#M88116 <P>The fieldname you're using in stats in first query is <CODE>Properties.platformData.HC</CODE> which exists and stats works. The eval here may not be doing anything as <CODE>|eval hardwaretype=Properties.platformData.HC</CODE> is basically trying to concatenate values of fields <CODE>Properties</CODE> with field <CODE>platformDate</CODE> and field <CODE>HC</CODE>. The dot there is treated as concatenation operator. Assuming you don't have fields Properties<CODE>,</CODE>platformDate<CODE>and</CODE>HC<CODE>in your data, the eval fails to populate field hardware type. That's why the second search failed. <BR /> You should either use the field</CODE>Properties.platformData.HC<CODE>in your stats like query 1 OR enclose the</CODE>Properties.platformData.HC` in single quotes in eval, like this:</P> <PRE><CODE>index=wholesale_app buildTarget=comcast analyticType=SessionStart |eval hardwaretype='Properties.platformData.HC'|stats count by hardwaretype </CODE></PRE> Tue, 21 Nov 2017 00:01:47 GMT https://community.splunk.com/t5/Splunk-Search/eval-command/m-p/291700#M88116 somesoni2 2017-11-21T00:01:47Z https://community.splunk.com/t5/Splunk-Search/eval-command/m-p/291701#M88117 <P>When you take out the stats command, does <CODE>hardwaretype</CODE> come back as a field with values?<BR /> Can you try <CODE>|eval hardwaretype='Properties.platformData.HC'</CODE> or <CODE>|rename "Properties.platformData.HC" as hardwaretype</CODE></P> Tue, 21 Nov 2017 00:03:32 GMT https://community.splunk.com/t5/Splunk-Search/eval-command/m-p/291701#M88117 cmerriman 2017-11-21T00:03:32Z https://community.splunk.com/t5/Splunk-Search/eval-command/m-p/291702#M88118 <P>interesting so the dot has dual purpose? Meaning the only way I know how to refer to a json object that has multiple levels is</P> <P>level1.level2.level3</P> <P>and the dot is used for concatenation as well</P> <P>thats not confusing at all <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Thanks Somesoni2!!! Saved large clumps of my hair <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 21 Nov 2017 01:29:27 GMT https://community.splunk.com/t5/Splunk-Search/eval-command/m-p/291702#M88118 dbcase 2017-11-21T01:29:27Z https://community.splunk.com/t5/Splunk-Search/eval-command/m-p/291703#M88119 <P>Hi Cmerriman,</P> <P>without the single quotes hardware model just comes back as blank/null </P> <P>once the single quotes were added things started working as expected.</P> Tue, 21 Nov 2017 01:50:53 GMT https://community.splunk.com/t5/Splunk-Search/eval-command/m-p/291703#M88119 dbcase 2017-11-21T01:50:53Z