topic Re: Foreach weird bug in variable in Splunk Search

Foreach weird bug in variable

greggz — Thu, 18 Jan 2018 14:46:48 GMT

So I have this chunk of code

eval matched=0 | foreach UF* [eval matched = if(like('<<FIELD>>',valMask),matched+1,matched) | eval Property = if(matched>=1,Property,null)]

Amusingly if the matched variable equals 1, the Property will get null value, when I explicity say that if it is bigger or equal than 1, the Property should remain with her original value.

Proof matched = 1

Thoughts on this ?

Thanks

Re: Foreach weird bug in variable

mayurr98 — Thu, 18 Jan 2018 15:09:52 GMT

Can you try

eval matched=0 | foreach UF* [eval matched = if(like('<<FIELD>>',valMask),matched+1,matched) ]| foreach UF* [eval Property=if(matched>=1,Property,null)]

Re: Foreach weird bug in variable

greggz — Thu, 18 Jan 2018 15:42:57 GMT

Same result.. What was your reasoning ?

Re: Foreach weird bug in variable

elliotproebstel — Thu, 18 Jan 2018 16:22:09 GMT

The structure generally looks ok, so I'm kind of reaching here. Any chance Property was null before the second half of the foreach ran? If you remove the second eval clause, is Property always populated?

Re: Foreach weird bug in variable

greggz — Thu, 18 Jan 2018 16:28:15 GMT

I removed the eval clause, and all the Properties get populated..

Re: Foreach weird bug in variable

greggz — Thu, 18 Jan 2018 16:32:45 GMT

The only possibility I'm seeing is that matched is still 0 inside the foreach. Like a lazy interation

Re: Foreach weird bug in variable

greggz — Thu, 18 Jan 2018 16:35:54 GMT

So apparently, matched inside the foreach is still 0. Something like Lazy Evaluation, but I don't really know. Anyway.. this works

foreach UF* [eval matched = if(like('<<FIELD>>',valMask),matched+1,matched)] | eval Property =  if(matched>=1,Property,null)