- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

mjm295
Path Finder
08-20-2015
03:08 PM
Hi Guys
I have a search string which quotes field names with $ and works great. However, when I put that into a panel on a dashboard, I get the "waiting for input" message on the panel.
Search string:
index=aws-bill user:showback!="" | eval showback=case(match($user:showback$, "IT Enterprise Services:*"), "INFRA", match($user:showback$, "IT:*"), "OtherIT", match($user:showback$, "Websites:*"), "WEBSITES", 1=1, "OLDDATA") | timechart sum(BlendedCost) as $ by showback useother=f limit=10
If I remove the $ quotes, eval complains about malformed expression due to the colon in the name.
So what am I doing wrong?
Mark
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
08-20-2015
03:57 PM
Consider renaming the field to something without a colon in it.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
08-20-2015
03:57 PM
Consider renaming the field to something without a colon in it.
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

mjm295
Path Finder
08-20-2015
06:20 PM
Thanks Rich - that's working now. never come across "rename" before.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

mjm295
Path Finder
08-20-2015
05:06 PM
Thanks for the suggestion but how would I do that? I've tried:
index=aws-bill user:showback!="" | rex field=_raw mode=sed "s/\://g" | eval showback=case(match(usershowback, "IT Enterprise Services:*"), "INFRA", match(usershowback, "IT:*"), "JUSTIT", match(usershowback, "Websites:*"), "WEBSITES", 1=1, "OLDDATA") | timechart sum(BlendedCost) as $ by showback useother=f limit=10
The colon is gone in the raw data but the eval is not picking it up.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

richgalloway

SplunkTrust
08-20-2015
05:53 PM
Try this
index=aws-bill user:showback!="" | rename "user:showback" as user_showback | eval showback=case(match($user_showback$, "IT Enterprise Services:*"), "INFRA", match($user_showback$, "IT:*"), "OtherIT", match($user_showback$, "Websites:*"), "WEBSITES", 1=1, "OLDDATA") | timechart sum(BlendedCost) as $ by showback useother=f limit=10
---
If this reply helps you, Karma would be appreciated.
If this reply helps you, Karma would be appreciated.
