Splunk Search
Highlighted

HTTP Event Collector: Why am I getting "Null" for event data using eval to concatenate field values?

Builder

Hi,

I'm trying out the new HTTP Event Collector, but I'm having problems searching the data.

Basically, the raw data looks like this:

{"user":"Louie","task":{"description":"HTTPSplunking 3","code":123},"duration":1800,"finish_time":1443535112}

And there are several similar events for Huey, Dewey and Louie. In the search, Splunk correctly identifies the varous task.code and task.description fields. Nice! task.code is always a number. However, my problems are that I want to use eval to concatenate user and task.code, but in that context, task.code does not seem to have any value.

For example:

... task.description="HTTPSplunking*" |eval usertask=user + ":" +tostring(task.code) 

results in usertask having the values "Huey:Null", "Dewey:Null", "Louie:Null". If I omit tostring(), then usertask does not get any value at all. Same thing if I use task.description instead.

So I tried

|eval task_code_null=if(isnull(task.code),"yes","no")

and task_code_null is always "yes". BUT, stats is able to calculate sum(task.code) so it does not seem completely null.

Does anyone else have this problem? Bug or feature?

Highlighted

Re: HTTP Event Collector: Why am I getting "Null" for event data using eval to concatenate field values?

Splunk Employee
Splunk Employee

As far as I know, the . in eval actually means "concatenate", which is causing problems when you have a field like task.code.

For example, I have this search:

index=stash2 sourcetype=commits | head 100 | eval changes.foo=10 | eval usertask=username. ":" .changes.foo

and it won't work, as there is no field called changes and no field called foo. However, if I change it to this:

index=stash2 sourcetype=commits | head 100 | eval changes.foo=10 | rename changes.foo AS changes_foo | eval usertask=username. ":" .changes_foo

then it works just fine, as now it doesn't need to disambiguate the .. I hoped that the tostring() you had would solve this, but it doesn't seem like it. In short, I'd just do an inline rename of your field.

View solution in original post

Highlighted

Re: HTTP Event Collector: Why am I getting "Null" for event data using eval to concatenate field values?

Builder

Yes, rename works well! Thanks!

Funny, I thought that + was the only concatenation operator. Ironic, since I have a Perl background and . comes natural to me. I wonder if this is going to change, because I fear this behaviour will surprise many users.

0 Karma