Splunk Search

How to apply eval to fields with complex names?

duesser
Path Finder

I am basically faced with this problem:

 

 

| makeresults count=3
| streamstats count
| eval a.1 = case(count=1, 1, count=2, null(), count=3, "null")
| eval a.2 = case(count=1, "null", count=2, 2, count=3, null())
| eval a3 = case(count=1, null(), count=2, "null", count=3, 3)
| table a*
| foreach mode=multifield * [eval <<FIELD>>=if(<<FIELD>>="null",null(),'<<FIELD>>')]

 

 

I have fields that contain a `.`. This screws up the `foreach` command. Is there a way to work around this? I have tried using `"<<FIELD>>"` but to no avail. 

I think it would work to rename all "bad" names, loop trough them and rename them back, but if possible I would like to avoid doing this.

 

 

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Use single quotes around field names when on the right of an assignment

| makeresults count=3
| streamstats count
| eval a.1 = case(count=1, 1, count=2, null(), count=3, "null")
| eval a.2 = case(count=1, "null", count=2, 2, count=3, null())
| eval a3 = case(count=1, null(), count=2, "null", count=3, 3)
| table a*
| foreach mode=multifield * [eval <<FIELD>>=if('<<FIELD>>'="null",null(),'<<FIELD>>')]
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...