Search Splunk swears on the field with a dot

[metylkinandrey]

Good afternoon! We have a need to send a field with a dot in the message: result.code.
But the request in which I specify this field fails.
Request:

index="main" sourcetype="testsystem-script99"
| transaction maxpause=10m srcMsgId Correlation_srcMsgId messageId result.code
| table _time srcMsgId Correlation_srcMsgId messageId result.code
| fields _time srcMsgId Correlation_srcMsgId messageId result.code
| sort srcMsgId _time
| streamstats current=f window=1 values(_time) as prevTime by subject
| eval timeDiff=_time-prevTime
| delta _time as timeDiff
| where (result.code)>0

Error:
Error in 'where' command: Type checking failed. The '>' operator received different types.

The search job has failed due to an error. You may be able view the job in the Job Inspector.

The error does not occur with the following options: resultcode, result-code, result_code.

Tell me please, what could be the problem?

[gcusello]

Hi @metylkinandrey,

you can use the hint from @richgalloway and @ITWhisperer using quotes or, better in my mind, to rename the field containing dot, especially if you have to use it many times in your searches.

index="main" sourcetype="testsystem-script99"
| rename result.code AS result_code
| transaction maxpause=10m srcMsgId Correlation_srcMsgId messageId result_code
| table _time srcMsgId Correlation_srcMsgId messageId result_code
| sort srcMsgId _time
| streamstats current=f window=1 values(_time) as prevTime by subject
| eval timeDiff=_time-prevTime
| delta _time as timeDiff
| where result_code>0

in addition, you don't need to use fields command after table command.

Ciao.

Giuseppe

[richgalloway]

Try putting the field name within single quotes.  Single quotes tell Splunk the enclosed text is a field name rather than a literal string and avoids confusion caused by spaces and other odd characters. 

| where 'result.code' > 0

[ITWhisperer · Accepted solution]

Field names with special characters such as dots should be enclosed in single quotes

| where 'result.code'>0

[metylkinandrey]

wow, it works! Thank you!