Splunk Search

Eval function on a column that has spaces

ttanasovski
Explorer

Table blah, “has a space” |eval tonumber(“has a space”)/2

Do you know a way to do the above that works? In the above, it treats “has a space” as a string rather than the data in the column. My workaround is:

table blah, "has a space"|rename “has a space” as blah2|eval tonumber(blah2)/2|rename blah2 “has a space”

There has to be an easier way.

Tags (3)

jda258
Engager

I found the answer here: http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Eval

You have to use single quotes instead of double quotes when referencing fields inside of eval functions:

Table blah, “has a space” |eval tonumber('has a space')/2

jda258
Engager

Also tricky is when assigning a result to a field as you need double quotes:

eval "field with spaces"=round('field with spaces')

Kate_Lawrence-G
Contributor

I would add a field extraction to pull out just the number from either the field or _raw data. If you pull out just a number into a field then Splunk will treat it as a number and you can perform functions on it.

0 Karma

sideview
SplunkTrust
SplunkTrust

I have found a place where I need this, where the eval statement is happening in something automated. I tried the {} trick and it didn't work sadly. Namely --- given a field foo whose value is "fooValue", | eval {foo}=12 will create a field called fooValue whose value is 12. Not super widely known, but quite useful.

At any rate, from this you might hope that {"my field name has spaces"} would work in eval as a syntax to get around the problem, but sadly it doesn't. There's no error which is odd, but it doesn't end up referencing the field name with the spaces.

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Just do field extractions without spaces in the field names.

0 Karma

sowings
Splunk Employee
Splunk Employee

My experience has been that you'll need the rename.

0 Karma

ttanasovski
Explorer

So looking at my actual problem, it still stands. The tonumber is a bit of a red herring. I didn't actually need to use tonumber. The problem is that I want to use anything in eval with spaces. This is an extract, but the column name has a space in it.

table blah, "has a space"|rename “has a space” as blah2|eval blah2/2|rename blah2 “has a space”

If I try to do the following, I get an error:
table blah, "has a space" |eval "has a space"/2

How can I do the above without the rename?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...