How to query multiple conditions when the field name has a space

[vjverma]

I need to run a query on the following lines:

index=i source=s earliest=-7W@W latest=@W | timechart span=1w count AS Overall count(eval(field1>0 )) AS F1Count count(eval("Field 2">0)) AS F2Count

The "Field 2" results in a syntax error saying "The eval expression for dynamic field '"Field 2">0' is invalid"

I can't rename the "Field 2". Is they any other way to query this data.

I could do
index=i source=s earliest=-7W@W latest=@W "Field 2">0| timechart span=1w count AS F2Count

but this requires me to run this query multiple times for each field.

[martin_mueller · Accepted solution]

Of course you can rename Field 2:

index=i source=s earliest=-7W@W latest=@W | rename "Field 2" as Field_2 | timechart span=1w count AS Overall count(eval(field1>0 )) AS F1Count count(eval(Field_2>0)) AS F2Count

Alternatively you can use single quotes in eval:

index=i source=s earliest=-7W@W latest=@W | timechart span=1w count AS Overall count(eval(field1>0 )) AS F1Count count(eval('Field 2'>0)) AS F2Count

Double quotes would make that a string that can't be compared with a number, causing that error.

[vjverma]

Thank you. Worked like a charm.