Splunk Enterprise

how to write eval inside tstats command?



we want to combined two fields by using eval inside the tstats where clause search. Please see my search below

| tstats latest(result._time) as _time ,values(result.relational_correlationId) as relational_correlationId,values(result.tracePoint) as tracePoint,values(result.timestamp) as timestamp,values(result.content.businessFields{}.key) as content.businessFields{}.key,values(result.content.businessFields{}.value) as content.businessFields{}.value where index="hec_example1" by result.environment,result.businessGroup,result.appName,result.interfaceName,result.correlationId |rename result.environment as environment,result.businessGroup as businessGroup,result.appName as appName,result.interfaceName as interfaceName,result.correlationId as correlationId| table _time,environment,businessGroup,appName,interfaceName,tracePoint,timestamp,correlationId,content.businessFields{}.key,content.businessFields{}.value


Please help me on this.

Labels (1)
Tags (3)
0 Karma

I believe tstats does not support eval.
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...