Splunk Search

How do I use a field with a dash (-) in an "if" search?

jwhughes58
Communicator

I get a minus error if the search if looks like this:

index=my_index sourcetype=my_sourcetype
| eval my_field = if (isnotnull(my_field), my_field_2, my.field-2)

I can work around it my changing the SPL to

index=my_index sourcetype=my_sourcetype
| rename my.field-1 AS my_field_1
| eval my_field = if (isnotnull(my_field), my_field_2, my.field-1)

I tried quoting, but the value of my_field became "my.field-2" and not the value. Is there a way of escaping my.field-1 in the "if" so it reads the contents or will I have to use a rename?

TIA,
Joe

0 Karma
1 Solution

493669
Super Champion

try single quote around field name like 'my.field-2'

View solution in original post

493669
Super Champion

try single quote around field name like 'my.field-2'

jwhughes58
Communicator

I thought I had tried that, but it looks like I didn't since it worked.

0 Karma

493669
Super Champion

glad it worked 😉

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...