Reporting

Use a Special characters

Ant3xes
Engager

Hello,

I want to use the eval search command but i have a little problem.

 

 

 

 

index=* host="*" source="/applis" legs{}.status=* | eval error = if(legs{}.status == 200, "OK", "Problem") | chart count by error

 

 

 

 

When i use legs{}.status field it don't work, i think it's cause of my quotes.

Someone who know how to use that field ?

Thank you and sorry for my bad english

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You need to put your field name in single quotes if it has a dot in. Try: 

index=* host="*" source="/applis" 'legs{}.status'=* | eval error = if('legs{}.status' == 200, "OK", "Problem") | chart count by error

 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You need to put your field name in single quotes if it has a dot in. Try: 

index=* host="*" source="/applis" 'legs{}.status'=* | eval error = if('legs{}.status' == 200, "OK", "Problem") | chart count by error

 

0 Karma

Ant3xes
Engager

Thank you ! I only tried with double quotes 😅

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...