I have a dataset with a regular expression where i extract the hostname of the computer to a
However, in the searches i base this on, a lower case hostname does not work.
How can I add a simple eval to the dataset that does
| eval hostname=upper(hostname) ?
(The error I get when i try to do this in the GUI is
Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])
the base event is just a regular cookie-cutter
There are a number of auto extracted fields in the data set, and one regular expression which extracts the hostname from a certain field in the dataset. The hostname is typed manually and sometimes is input in lowercase. When the field is extracted and additional logic is applied to the lowercase hostname, things break.
So the search is kind of irrelevant, since apparently I cant do
|eval hostname=upper(hostname) in the web gui for the data set, no matter what type of field extraction I choose.
@christoffertoft can you add some sample data and also your query?
If you are using
where and lowercase hostname does not work can you replace where with
search which should do case insensitive match.
| eval hostname=upper(hostname) should work. Refer to following run anywhere search.
| makeresults | eval hostname="abc123" | eval hostname=upper(hostname)