Archive

How to reference a Field Name containing "()" without breaking the search or stats?

New Member

I have a field name that contains "(rpm)" and cannot find a way to reference it without it breaking a search or stats. What can I do to escape or otherwise reference the field?

Bob

0 Karma

Esteemed Legend

You can enclose field names within dollar signs like this:

... | eval xyz_rpm = $xyz (rpm)$
0 Karma

SplunkTrust
SplunkTrust

Within transforming commands (eval, stats, timechart etc) and WHERE command, use the field within single quote 'YourField(ABC)'

For other places (table, fields, search) put it within double quotes.

0 Karma

Legend

Have you tried the rename command?

... | rename "xyz (rpm)" as xyz_rpm | ...

I know you probably didn't create the field name this way, but FYI:

Field names that are made from the following character set will never require quotation marks and will be properly understood by all Splunk commands:

Upper case letters (A-Z)
Lower case letters (a-z)
Digits (0-9)
Underscore (_)

Field names should begin with a letter.

0 Karma

Influencer

Have you tried single quotes? 'fieldname'

Another option is to use either a field alias (in props.conf or in Splunk Web on the Search Head via Settings -> Fields -> Field alias), or a rename in your search before doing stats, eval, etc.

Influencer

Also, if it's in the sidebar, click on it, select a value (to add it to your search) and see how Splunk references it.

0 Karma

Legend

Field alias is also available from the GUI: Go to Settings -> Fields -> Field alias

0 Karma