Knowledge Management

lookup fields cannot be calculated using eval

jyab6z
Path Finder

Hi,

I have problem with eval for those fields generated by lookup, here is my search:

my basic search | table DATE TimeInSec UserID Function Serie_nr prodClass prod_nr | lookup test.csv Product as prod_nr OUTPUT Product_class as prodClass_temp_csv, Development_stage as Serie_nr_csv | eval total_serie = Serie_nr + Serie_nr_csv | eval total_prodClass = prodClass + prodClass_temp_csv

But for some reason, total_serie field does not even show up in the Statistics and total_prodClass shows only the values of prodClass, not prodClass_temp_csv.

Any idea?

Tags (1)
0 Karma

somesoni2
Revered Legend

What type of values does your lookup table has for field Development_stage and Product_class? String or numbers? Did you check if your lookup table do have matching Product from base search?

0 Karma

jyab6z
Path Finder

Hi @somesoni2,

Development_stage and Product_class could contian both types, actually I wanna join those fields, not sum of those. I have checked the lookup as well, the matched results exist in the table.

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...