Fieldformat didn't work with foreach

[isoutamo]

Hi

for some reason fieldformat didn't work with foreach x,y,z. Sometimes it works mostly didn't. Here is same which didn't work in at least our Splunk 7.3.3 or 8.0.5. Any hints is welcome.

index=_* earliest=-w@w latest=@d| fields _indextime, _time
| eval lat=_indextime - _time
| bin span=1w _time
| stats count as Events avg(lat) as AvgLat max(lat) as MaxLat min(lat) as MinLat by _time
| eval AvgLatMins = round (AvgLat/60, 0), AvgLatHrs = round (AvgLatMins / 60,0), AvgLat = round (AvgLat, 0), MaxLat = round(MaxLat ,0)
| foreach AvgLat MinLat MaxLat
    [eval <<FIELD>> = if (<<FIELD>> < 0, 0, <<FIELD>>) 
    | fieldformat <<FIELD>> = tostring (<<FIELD>>, "duration")]

 When I change fieldformat to eval it works or if I do fielformat for individual fields one by one it works. And no changes even I try " and ' with <<FIELD>> (shouldn't need based on those field names).

r. Ismo

[mhoogcarspel_sp · Accepted solution]

I've just reproduced this and logged it to Engineering (SPL-194199, not in the release notes yet) based on a customer case that mentioned this.

I will drop this in the release notes once I have feedback from Engineering.

[isoutamo]

Thanks

We already have open case with Splunk support. 

r. Ismo

[mhoogcarspel_sp]

Just check, it was your case actually

[bowesmana]

Interesting, it looks as though fieldformat does not work inside the foreach, e.g.

| eval xx=1234 
| fieldformat xx=tostring(xx, "duration") 

This also does not work, it just leaves 1234 in the output.

The search log shows it seems to be evaluating the foreach correctly. I've not managed any 'sometimes' - it always fails for me. Any fieldformat inside the foreach simply ignores the fieldformat, whereas outside it's fine.

[isoutamo]

Thanks @bowesmana 

Before 7.x.x or works, if I recall right? Same dashboards formatted correctly, but after update not. Maybe it’s time to create case to splunk.

r. Ismo

[bowesmana]

I've rarely used fieldformat, so haven't come across this before. I'm not actually sure what the net effect of using fieldformat vs eval would be in practice in any case.

But yes, it does seem like a bug if it used to work, as the most basic case, of not even using any of the foreach X variables, does not work.

[isoutamo]

Hi

the real difference between eval and fieldformat is that eval changes type e.g. to string and fieldformat keeps the original type, even it look like string. For that reason you could sort those columns correctly on screen with fieldformat and not after eval. This is(was) very useful when you have lot of numeric columns with big numbers 10^6 or bigger and want to see those in format x,xxx,xxx.yy. Works earlier like charm for 10+ fields with foreach + fieldformat. Other option is change that formatting one by one field via GUI 😞

r. Ismo

[bowesmana]

Thanks for that @isoutamo. I've always done sort followed by formatting and never realised the subtle difference. Good to know.