Splunk Search

How do I match a field to a variable?

kkatzgraukeyw
Explorer

I've got a query that will have a string passed into it. In this case, it's "2-Low". I need to parse out the number and match that to rows with a field called 'score' containing the same value.

Strangely enough, this query isn't returning results (there is definitely matching data):

index=someindex | parser | eval ar = split("2-Low","-") | eval tl = mvindex(ar, 0) | search score = tl

As a sanity check, if I try this to make sure the string manipulation worked, I get the number "2" as expected.

index=someindex | parser | eval ar = split("2-Low","-") | eval tl = mvindex(ar, 0) | fields tl

Any thoughts on what I might not be doing correctly?

Tags (2)
0 Karma

woodcock
Esteemed Legend

The problem is that you are using search instead of where. The search command ALWAYS understands the Right-Hand-Value to be a string-literal whereas where presumes the RHV to be a fieldname and switches to treating it as a string-literal only if you force it to, such as by enclosing it in double-quotes.

martin_mueller
SplunkTrust
SplunkTrust

where does NOT switch to treating a fieldname as a string literal if that field does not exist. Doing so would be terrible. Example:

| stats count | eval field = "foo" | where field = "foo"
| stats count | eval field = "foo" | where field = foo

By your reasoning, both searches should keep the one event generated by the stats. However, the field foo does not exist, hence it's comparing field to null() yielding false and dropping the event. This is the only sane behaviour imaginable.

Additionally, I would recommend against enclosing RHS fields in dollar signs because that would break when included in dashboards - those would then treat the dollar-sign-fieldname as a form token. Instead, enclose the field name in single quotes as documented here: http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Eval#Required_arguments

0 Karma

woodcock
Esteemed Legend

You are correct, I have adjusted my answer to reflect the more correct nuance.

0 Karma

kkatzgraukeyw
Explorer

Perfect. Thanks for the explanation!

0 Karma

woodcock
Esteemed Legend

You should click "Accept" to close out the question.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...