Splunk Search

Issue adding a symbol after a field value

UMDTERPS
Communicator

The following previous splunk thread works fine:

https://community.splunk.com/t5/Archive/Insert-sign-for-each-result-in-a-specific-column/m-p/149167


| eval sensor = sensor + " %"
51%


However,  if the field name has a space, it does not work:

| eval "System Outlook" = "System Outlook" + " %"
System Outlook %

 

I'm assuming it needs some sort of backslash escaping? (I've tried a bunch of ways). I know I can just rename it without the space, but I want to keep the space.

Any ideas?

Labels (2)
Tags (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

When using field names with non standard characters, you need to use single quotes on the right hand side of the eval statement, i.e.

| eval "System Outlook" = 'System Outlook' + " %"

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

When using field names with non standard characters, you need to use single quotes on the right hand side of the eval statement, i.e.

| eval "System Outlook" = 'System Outlook' + " %"

 

UMDTERPS
Communicator

Perfect, that worked!

 

Thanks!😀

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...