Use a Special characters

[Ant3xes]

Hello,

I want to use the eval search command but i have a little problem.

index=* host="*" source="/applis" legs{}.status=* | eval error = if(legs{}.status == 200, "OK", "Problem") | chart count by error

When i use legs{}.status field it don't work, i think it's cause of my quotes.

Someone who know how to use that field ?

Thank you and sorry for my bad english

[ITWhisperer · Accepted solution]

You need to put your field name in single quotes if it has a dot in. Try: 

index=* host="*" source="/applis" 'legs{}.status'=* | eval error = if('legs{}.status' == 200, "OK", "Problem") | chart count by error

[Ant3xes]

Thank you ! I only tried with double quotes 😅