How do I match a field to a variable?

[kkatzgraukeyw]

I've got a query that will have a string passed into it. In this case, it's "2-Low". I need to parse out the number and match that to rows with a field called 'score' containing the same value.

Strangely enough, this query isn't returning results (there is definitely matching data):

index=someindex | parser | eval ar = split("2-Low","-") | eval tl = mvindex(ar, 0) | search score = tl

As a sanity check, if I try this to make sure the string manipulation worked, I get the number "2" as expected.

index=someindex | parser | eval ar = split("2-Low","-") | eval tl = mvindex(ar, 0) | fields tl

Any thoughts on what I might not be doing correctly?

[woodcock]

The problem is that you are using search instead of where. The search command ALWAYS understands the Right-Hand-Value to be a string-literal whereas where presumes the RHV to be a fieldname and switches to treating it as a string-literal only if you force it to, such as by enclosing it in double-quotes.

[martin_mueller]

where does NOT switch to treating a fieldname as a string literal if that field does not exist. Doing so would be terrible. Example:

| stats count | eval field = "foo" | where field = "foo"
| stats count | eval field = "foo" | where field = foo

By your reasoning, both searches should keep the one event generated by the stats. However, the field foo does not exist, hence it's comparing field to null() yielding false and dropping the event. This is the only sane behaviour imaginable.

Additionally, I would recommend against enclosing RHS fields in dollar signs because that would break when included in dashboards - those would then treat the dollar-sign-fieldname as a form token. Instead, enclose the field name in single quotes as documented here: http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Eval#Required_arguments

[woodcock]

You are correct, I have adjusted my answer to reflect the more correct nuance.

[kkatzgraukeyw]

Perfect. Thanks for the explanation!

[woodcock]

You should click "Accept" to close out the question.