Splunk Search

HTTP Event Collector: Why am I getting "Null" for event data using eval to concatenate field values?

echalex
Builder

Hi,

I'm trying out the new HTTP Event Collector, but I'm having problems searching the data.

Basically, the raw data looks like this:

{"user":"Louie","task":{"description":"HTTPSplunking 3","code":123},"duration":1800,"finish_time":1443535112}

And there are several similar events for Huey, Dewey and Louie. In the search, Splunk correctly identifies the varous task.code and task.description fields. Nice! task.code is always a number. However, my problems are that I want to use eval to concatenate user and task.code, but in that context, task.code does not seem to have any value.

For example:

... task.description="HTTPSplunking*" |eval usertask=user + ":" +tostring(task.code) 

results in usertask having the values "Huey:Null", "Dewey:Null", "Louie:Null". If I omit tostring(), then usertask does not get any value at all. Same thing if I use task.description instead.

So I tried

|eval task_code_null=if(isnull(task.code),"yes","no")

and task_code_null is always "yes". BUT, stats is able to calculate sum(task.code) so it does not seem completely null.

Does anyone else have this problem? Bug or feature?

1 Solution

ineeman
Splunk Employee
Splunk Employee

As far as I know, the . in eval actually means "concatenate", which is causing problems when you have a field like task.code.

For example, I have this search:

index=stash2 sourcetype=commits | head 100 | eval changes.foo=10 | eval usertask=username. ":" .changes.foo

and it won't work, as there is no field called changes and no field called foo. However, if I change it to this:

index=stash2 sourcetype=commits | head 100 | eval changes.foo=10 | rename changes.foo AS changes_foo | eval usertask=username. ":" .changes_foo

then it works just fine, as now it doesn't need to disambiguate the .. I hoped that the tostring() you had would solve this, but it doesn't seem like it. In short, I'd just do an inline rename of your field.

View solution in original post

ineeman
Splunk Employee
Splunk Employee

As far as I know, the . in eval actually means "concatenate", which is causing problems when you have a field like task.code.

For example, I have this search:

index=stash2 sourcetype=commits | head 100 | eval changes.foo=10 | eval usertask=username. ":" .changes.foo

and it won't work, as there is no field called changes and no field called foo. However, if I change it to this:

index=stash2 sourcetype=commits | head 100 | eval changes.foo=10 | rename changes.foo AS changes_foo | eval usertask=username. ":" .changes_foo

then it works just fine, as now it doesn't need to disambiguate the .. I hoped that the tostring() you had would solve this, but it doesn't seem like it. In short, I'd just do an inline rename of your field.

echalex
Builder

Yes, rename works well! Thanks!

Funny, I thought that + was the only concatenation operator. Ironic, since I have a Perl background and . comes natural to me. I wonder if this is going to change, because I fear this behaviour will surprise many users.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...