Splunk Search

Can't use eval function on fields extracted from json log using spath

myobmatt
New Member

I have extracted fields from a json log using spath, I want to add double quotes to the tabled results using ... | eval myval="\"".myval."\"" but no eval function seems to work on the fields extracted in this way. What am I doing wrong??

Tags (1)
0 Karma

niketn
Legend

@myobmatt can you add some JSON data sample along with the field name that spath extracts?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

myobmatt
New Member

Any field that I have extracted from the json log using spath, when I try to apply ANY eval function, comes up blank when I try to table it

0 Karma

tiagofbmm
Influencer

Hi

You jus need one set of \" in the beginning and one in the end, like this

| eval myval="\""+myval+"\""
0 Karma

tiagofbmm
Influencer

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that

0 Karma

493669
Super Champion

Hi
have you tried this:

|eval myval="\"".myval."\""
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

You use Splunk every day, come and help shape what's next.  Save Your Seat: Product-Focused Sessions at ...

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

The Problem: Too Many Alerts, Too Little Context Security operations teams running Splunk Enterprise Security ...

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Watch Now Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas     Do you ever feel ...