Splunk Search

Any idea why eval doesn't assign value

Ruslan
Engager

Query example:

 

 

 

index=eks sourcetype="kube:container" message=log
| fields data.user_agent
| rex field=data.user_agent mode=sed "s/[0-9]//g"
| rex field=data.user_agent mode=sed "s/\.//g"
| eval agent = data.user_agent
| table data.user_agent, agent

 

 

 

After this query `agent` column is empty. While data.user_agent is filled with data.

Was expecting to have a text copy.

Also if will add some logic, based on data.user_agent it will not work for reason as well:

 

 

 

index=eks-prod sourcetype="kube:container:api-auth" message=web_login
| fields data.user_agent
| rex field=data.user_agent mode=sed "s/[0-9]//g"
| rex field=data.user_agent mode=sed "s/\.//g"
| eval agent = if(like(data.user_agent, "Mozilla%"), "browser", "device")
| stats count by agent

 

 

 

this will produce result with always "device", never "browser"

Labels (1)
0 Karma
1 Solution

renjith_nair
Legend

Try

| eval agent = 'data.user_agent'
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

@Ruslan 

In eval statements, always wrap field names that contain anything other than letters with single quotes. Same applies to fields starting with numbers.

 

renjith_nair
Legend

Try

| eval agent = 'data.user_agent'
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...