Splunk Search

Fieldformat didn't work with foreach

Champion

Hi

for some reason fieldformat didn't work with foreach x,y,z. Sometimes it works mostly didn't. Here is same which didn't work in at least our Splunk 7.3.3 or 8.0.5. Any hints is welcome.

 

index=_* earliest=-w@w latest=@d| fields _indextime, _time
| eval lat=_indextime - _time
| bin span=1w _time
| stats count as Events avg(lat) as AvgLat max(lat) as MaxLat min(lat) as MinLat by _time
| eval AvgLatMins = round (AvgLat/60, 0), AvgLatHrs = round (AvgLatMins / 60,0), AvgLat = round (AvgLat, 0), MaxLat = round(MaxLat ,0)
| foreach AvgLat MinLat MaxLat
    [eval <<FIELD>> = if (<<FIELD>> < 0, 0, <<FIELD>>) 
    | fieldformat <<FIELD>> = tostring (<<FIELD>>, "duration")]

 

 When I change fieldformat to eval it works or if I do fielformat for individual fields one by one it works. And no changes even I try " and ' with <<FIELD>> (shouldn't need based on those field names).

r. Ismo

Labels (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

I've just reproduced this and logged it to Engineering (SPL-194199, not in the release notes yet) based on a customer case that mentioned this.

I will drop this in the release notes once I have feedback from Engineering.

View solution in original post

Splunk Employee
Splunk Employee

I've just reproduced this and logged it to Engineering (SPL-194199, not in the release notes yet) based on a customer case that mentioned this.

I will drop this in the release notes once I have feedback from Engineering.

View solution in original post

Champion

Thanks

We already have open case with Splunk support. 

r. Ismo

0 Karma

Splunk Employee
Splunk Employee

Just check, it was your case actually

0 Karma

Motivator

Interesting, it looks as though fieldformat does not work inside the foreach, e.g.

| eval xx=1234 
| fieldformat xx=tostring(xx, "duration") 

This also does not work, it just leaves 1234 in the output.

The search log shows it seems to be evaluating the foreach correctly. I've not managed any 'sometimes' - it always fails for me. Any fieldformat inside the foreach simply ignores the fieldformat, whereas outside it's fine.

0 Karma

Champion

Thanks @bowesmana 

Before 7.x.x or works, if I recall right? Same dashboards formatted correctly, but after update not. Maybe it’s time to create case to splunk.

r. Ismo

0 Karma

Motivator

I've rarely used fieldformat, so haven't come across this before. I'm not actually sure what the net effect of using fieldformat vs eval would be in practice in any case.

But yes, it does seem like a bug if it used to work, as the most basic case, of not even using any of the foreach X variables, does not work.

 

0 Karma

Champion

Hi

the real difference between eval and fieldformat is that eval changes type e.g. to string and fieldformat keeps the original type, even it look like string. For that reason you could sort those columns correctly on screen with fieldformat and not after eval. This is(was) very useful when you have lot of numeric columns with big numbers 10^6 or bigger and want to see those in format x,xxx,xxx.yy. Works earlier like charm for 10+ fields with foreach + fieldformat. Other option is change that formatting one by one field via GUI 😞


r. Ismo

Motivator

Thanks for that @soutamo. I've always done sort followed by formatting and never realised the subtle difference. Good to know.

 

0 Karma