- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

UMDTERPS
Communicator
01-13-2021
12:39 PM
The following previous splunk thread works fine:
https://community.splunk.com/t5/Archive/Insert-sign-for-each-result-in-a-specific-column/m-p/149167
| eval sensor = sensor + " %"
51%
However, if the field name has a space, it does not work:
| eval "System Outlook" = "System Outlook" + " %"
System Outlook %
I'm assuming it needs some sort of backslash escaping? (I've tried a bunch of ways). I know I can just rename it without the space, but I want to keep the space.
Any ideas?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bowesmana

SplunkTrust
01-13-2021
02:01 PM
When using field names with non standard characters, you need to use single quotes on the right hand side of the eval statement, i.e.
| eval "System Outlook" = 'System Outlook' + " %"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bowesmana

SplunkTrust
01-13-2021
02:01 PM
When using field names with non standard characters, you need to use single quotes on the right hand side of the eval statement, i.e.
| eval "System Outlook" = 'System Outlook' + " %"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

UMDTERPS
Communicator
01-14-2021
01:28 PM
