I want to use the eval command to create another field using an existing field. However, the existing field has multiple words. Normally, I would use quotation marks around the field, but eval treats that as a string.
|eval newfield="My Old Field"
This code would simple use the string "my Old Field" instead of values from a field called "My Old Field". How do i fix this?
Another way is to use single quotes for field names with difficult characters:
eval newfield='My Old Field'
Note that this works in eval and where clauses, but quoting in search commands in general is inconsistent.
Great, this works for advanced XML dashboards
|eval newfield=$My Old Field$
Great, it works 🙂