Splunk Search

Search on data model object, weird behavior

MemoreX42
Explorer

Hi guys,

i'm fairly new to Splunk and have a problem regarding searches on data models.
So what i did is, i created a data model which introduces a new field to my events by an evaluation. Now i'm trying to search on this data and create reports.
So what i'm doing in my searches looks like this:

| datamodel Probe CityProbe search | stats values(Probe.Class)

Where "Class" is a field of type number in the events of my data object. This works fine and it produces the different values that are in "Class".
Now i'm trying to execute some if statements on this "Class" field, so i do something like the following:

| datamodel Probe CityProbe search | eval n = if(Probe.Class==1, "true", "false") | stats values(n)

This fails with "Error in 'eval' command: Typechecking failed. The '==' operator received different types.". So i tried to find out of what type the "Probe.Class" field is and it turns out that it is NULL all the time. I don't get how this can be, since the first query, working on the same field, works.

By the way, when i do this on the index itself, without the data model, it works.

Can anyone please enlighten me on how this works?
Thanks in advance

Regards, Karsten

Tags (2)

anchalsingh
Explorer

Use single quote around the field to resolve error as mentioned in the comment.

... | eval n = if('Probe.Class'==1, "true", "false") | ...

I got my issue resolved using this.

tpflicke
Path Finder

I had the same message and resolved it by single-quoting the fields inside the eval statement so the following might do the trick:

... | eval n = if('Probe.Class'==1, "true", "false") | ...
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...