Splunk Search

Search on data model object, weird behavior

MemoreX42
Explorer

Hi guys,

i'm fairly new to Splunk and have a problem regarding searches on data models.
So what i did is, i created a data model which introduces a new field to my events by an evaluation. Now i'm trying to search on this data and create reports.
So what i'm doing in my searches looks like this:

| datamodel Probe CityProbe search | stats values(Probe.Class)

Where "Class" is a field of type number in the events of my data object. This works fine and it produces the different values that are in "Class".
Now i'm trying to execute some if statements on this "Class" field, so i do something like the following:

| datamodel Probe CityProbe search | eval n = if(Probe.Class==1, "true", "false") | stats values(n)

This fails with "Error in 'eval' command: Typechecking failed. The '==' operator received different types.". So i tried to find out of what type the "Probe.Class" field is and it turns out that it is NULL all the time. I don't get how this can be, since the first query, working on the same field, works.

By the way, when i do this on the index itself, without the data model, it works.

Can anyone please enlighten me on how this works?
Thanks in advance

Regards, Karsten

Tags (2)

anchalsingh
Explorer

Use single quote around the field to resolve error as mentioned in the comment.

... | eval n = if('Probe.Class'==1, "true", "false") | ...

I got my issue resolved using this.

tpflicke
Path Finder

I had the same message and resolved it by single-quoting the fields inside the eval statement so the following might do the trick:

... | eval n = if('Probe.Class'==1, "true", "false") | ...
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...