Splunk Search

Search on data model object, weird behavior

MemoreX42
Explorer

Hi guys,

i'm fairly new to Splunk and have a problem regarding searches on data models.
So what i did is, i created a data model which introduces a new field to my events by an evaluation. Now i'm trying to search on this data and create reports.
So what i'm doing in my searches looks like this:

| datamodel Probe CityProbe search | stats values(Probe.Class)

Where "Class" is a field of type number in the events of my data object. This works fine and it produces the different values that are in "Class".
Now i'm trying to execute some if statements on this "Class" field, so i do something like the following:

| datamodel Probe CityProbe search | eval n = if(Probe.Class==1, "true", "false") | stats values(n)

This fails with "Error in 'eval' command: Typechecking failed. The '==' operator received different types.". So i tried to find out of what type the "Probe.Class" field is and it turns out that it is NULL all the time. I don't get how this can be, since the first query, working on the same field, works.

By the way, when i do this on the index itself, without the data model, it works.

Can anyone please enlighten me on how this works?
Thanks in advance

Regards, Karsten

Tags (2)

anchalsingh
Explorer

Use single quote around the field to resolve error as mentioned in the comment.

... | eval n = if('Probe.Class'==1, "true", "false") | ...

I got my issue resolved using this.

tpflicke
Path Finder

I had the same message and resolved it by single-quoting the fields inside the eval statement so the following might do the trick:

... | eval n = if('Probe.Class'==1, "true", "false") | ...
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...