topic Re: Field not fillled through eval in map in Splunk Search

Field not fillled through eval in map

fvegdom — Mon, 29 May 2017 07:15:40 GMT

I have a search like this:

|inputlookup CSV-Generic-GenCus-GenLBL-SensitiveDataKeyWords.csv | map [search index="*" $keyword$ | eval kw=$keyword$, rex=$regex$ | regex($regex$)]

from some reason the kw field does not get a value, the kw field is displayed but It is always empty, if I look at search.log, I can see that the search is being parsed as:

( index="*" IBAN ) | eval kw=IBAN, rex="[a-zA-Z]{2}[0-9]{2}[a-zA-Z0-9]{4}[0-9]{7}([a-zA-Z0-9]?){0,16}" | regex ("[a-zA-Z]{2}[0-9]{2}[a-zA-Z0-9]{4}[0-9]{7}([a-zA-Z0-9]?){0,16}")

but in the results, rex does show a value, but kw does not. What am I missing here?

Re: Field not fillled through eval in map

woodcock — Mon, 29 May 2017 14:57:58 GMT

Show the output of this command:

|inputlookup CSV-Generic-GenCus-GenLBL-SensitiveDataKeyWords.csv | head 2

Re: Field not fillled through eval in map

fvegdom — Mon, 29 May 2017 19:58:56 GMT

Thanks for looking into this, that search gives me:

IBAN             [a-zA-Z]{2}[0-9]{2}[a-zA-Z0-9]{4}[0-9]{7}([a-zA-Z0-9]?){0,16}
AccountNumber    [a-zA-Z]{2}[0-9]{2}[a-zA-Z0-9]{4}[0-9]{7}([a-zA-Z0-9]?){0,16}

Re: Field not fillled through eval in map

woodcock — Mon, 29 May 2017 20:37:04 GMT

You need double-quotes, like this:

|inputlookup CSV-Generic-GenCus-GenLBL-SensitiveDataKeyWords.csv | map [search index="*" $keyword$ | eval kw="$keyword$", rex="$regex$" | regex($regex$)]

Re: Field not fillled through eval in map

fvegdom — Tue, 30 May 2017 08:22:01 GMT

aha, I understand, that also explains why the regex was already showing up in the results, it is already enclosed by double quotes in the original CSV.

works like a charm, thanks!

Re: Field not fillled through eval in map

woodcock — Thu, 12 Apr 2018 21:16:49 GMT

There are dangers to using the subsearch syntax ( [] ) instead of the normal double-quotes for map. It involves the fact that if your outer search is streaming (most likely), your subsearch will be restarted several times. If it does something like send an email with sendemail, you may find that it emails many times instead of the single time that you expected.