Splunk Search

Fieldformat didn't work with foreach

isoutamo
SplunkTrust
SplunkTrust

Hi

for some reason fieldformat didn't work with foreach x,y,z. Sometimes it works mostly didn't. Here is same which didn't work in at least our Splunk 7.3.3 or 8.0.5. Any hints is welcome.

 

index=_* earliest=-w@w latest=@d| fields _indextime, _time
| eval lat=_indextime - _time
| bin span=1w _time
| stats count as Events avg(lat) as AvgLat max(lat) as MaxLat min(lat) as MinLat by _time
| eval AvgLatMins = round (AvgLat/60, 0), AvgLatHrs = round (AvgLatMins / 60,0), AvgLat = round (AvgLat, 0), MaxLat = round(MaxLat ,0)
| foreach AvgLat MinLat MaxLat
    [eval <<FIELD>> = if (<<FIELD>> < 0, 0, <<FIELD>>) 
    | fieldformat <<FIELD>> = tostring (<<FIELD>>, "duration")]

 

 When I change fieldformat to eval it works or if I do fielformat for individual fields one by one it works. And no changes even I try " and ' with <<FIELD>> (shouldn't need based on those field names).

r. Ismo

Labels (1)
0 Karma
1 Solution

mhoogcarspel_sp
Splunk Employee
Splunk Employee

I've just reproduced this and logged it to Engineering (SPL-194199, not in the release notes yet) based on a customer case that mentioned this.

I will drop this in the release notes once I have feedback from Engineering.

View solution in original post

mhoogcarspel_sp
Splunk Employee
Splunk Employee

I've just reproduced this and logged it to Engineering (SPL-194199, not in the release notes yet) based on a customer case that mentioned this.

I will drop this in the release notes once I have feedback from Engineering.

isoutamo
SplunkTrust
SplunkTrust

Thanks

We already have open case with Splunk support. 

r. Ismo

0 Karma

mhoogcarspel_sp
Splunk Employee
Splunk Employee

Just check, it was your case actually

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Interesting, it looks as though fieldformat does not work inside the foreach, e.g.

| eval xx=1234 
| fieldformat xx=tostring(xx, "duration") 

This also does not work, it just leaves 1234 in the output.

The search log shows it seems to be evaluating the foreach correctly. I've not managed any 'sometimes' - it always fails for me. Any fieldformat inside the foreach simply ignores the fieldformat, whereas outside it's fine.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Thanks @bowesmana 

Before 7.x.x or works, if I recall right? Same dashboards formatted correctly, but after update not. Maybe it’s time to create case to splunk.

r. Ismo

0 Karma

bowesmana
SplunkTrust
SplunkTrust

I've rarely used fieldformat, so haven't come across this before. I'm not actually sure what the net effect of using fieldformat vs eval would be in practice in any case.

But yes, it does seem like a bug if it used to work, as the most basic case, of not even using any of the foreach X variables, does not work.

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

the real difference between eval and fieldformat is that eval changes type e.g. to string and fieldformat keeps the original type, even it look like string. For that reason you could sort those columns correctly on screen with fieldformat and not after eval. This is(was) very useful when you have lot of numeric columns with big numbers 10^6 or bigger and want to see those in format x,xxx,xxx.yy. Works earlier like charm for 10+ fields with foreach + fieldformat. Other option is change that formatting one by one field via GUI 😞


r. Ismo

bowesmana
SplunkTrust
SplunkTrust

Thanks for that @isoutamo. I've always done sort followed by formatting and never realised the subtle difference. Good to know.

 

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...