Hi guys,
i'm fairly new to Splunk and have a problem regarding searches on data models.
So what i did is, i created a data model which introduces a new field to my events by an evaluation. Now i'm trying to search on this data and create reports.
So what i'm doing in my searches looks like this:
| datamodel Probe CityProbe search | stats values(Probe.Class)
Where "Class" is a field of type number in the events of my data object. This works fine and it produces the different values that are in "Class".
Now i'm trying to execute some if statements on this "Class" field, so i do something like the following:
| datamodel Probe CityProbe search | eval n = if(Probe.Class==1, "true", "false") | stats values(n)
This fails with "Error in 'eval' command: Typechecking failed. The '==' operator received different types.". So i tried to find out of what type the "Probe.Class" field is and it turns out that it is NULL all the time. I don't get how this can be, since the first query, working on the same field, works.
By the way, when i do this on the index itself, without the data model, it works.
Can anyone please enlighten me on how this works?
Thanks in advance
Regards, Karsten
