topic Re: foreach with Error in 'eval' command in Splunk Search

foreach with Error in 'eval' command

kennethyeung — Tue, 29 Sep 2020 17:03:48 GMT

i want to have p_code_1 =close/close_1 and p_code_2=close/close_2

I found out i cannot post << Field >> and use --FIELD-- to replaice

Re: foreach with Error in 'eval' command

kamlesh_vaghela — Tue, 05 Dec 2017 09:02:24 GMT

hi @kennethyeung,

can you please use 101010 (code sample) to pose search or code ??

Re: foreach with Error in 'eval' command

niketn — Tue, 05 Dec 2017 09:22:29 GMT

@kennethyeung, please try the following, as per your requirement for fields p_code_1="close/close_1" and p_code_2="close/close_2", you should use <<MATCHSTR>> instead of <<FIELD>> value in foreach eval statement should be in double quotes:

| makeresults
| fields - _time
| eval code1=1 
| eval close_1=10
| eval close_2=5
| eval code2=3
| foreach code* [eval p_code_<<MATCHSTR>>="close/close_<<MATCHSTR>>"]

Re: foreach with Error in 'eval' command

kennethyeung — Tue, 05 Dec 2017 09:43:19 GMT

may i know that when use field and when use matchstr?

Thanks

Re: foreach with Error in 'eval' command

kennethyeung — Tue, 05 Dec 2017 10:11:06 GMT

@niketnilay want to ask, is it possible foreach lilke other script?
for example

in my previous search, i need to create eval code1=1, code2=3,
but actually the result is from In (1,3)

Thanks

Re: foreach with Error in 'eval' command

niketn — Tue, 05 Dec 2017 12:40:58 GMT

Please replace the foreach command with the following '<<field>>' should replace the selected field value:

| foreach code* [eval p_code_<<MATCHSTR>>="close/close_".'<<field>>']

Re: foreach with Error in 'eval' command

niketn — Tue, 05 Dec 2017 12:44:31 GMT

@kennethyeung, the documentation has different examples to explain these points.

<<field>>: Replaces the entire field

<<MATCHSTR>>: This is a part of the field which you can identify by replacing asterisk (*) in foreach i.e.

| foreach code* implies <<MATCHSTR>> will find 1 and 2 from fields code1 and code2 respectively.

Re: foreach with Error in 'eval' command

kennethyeung — Wed, 06 Dec 2017 02:20:46 GMT

Thanks you your explaination 🙂