Splunk Search

Strange foreach behaviour with wildcards

bowesmana
Champion

We all know that foreach * will work on all the fields in the result row right...

Well it seems that when using datamodels, the wildcard for fields is not what it seems

 

| from datamodel:DataModelName
| foreach * [ eval field_list=mvappend(field_list, "<<MATCHSTR>>") ]
| table field_list, * _raw

 

With the above running on a suitably populated data model, the wildcard in the foreach and the one in the table statement give a different set of fields - but not always.

The foreach * will normally show the data seen in the backing event mapped onto the data model, whereas the table * will show the datamodel fields names, even if those fields are null.

However, I have run searches today, where the foreach statement is actually getting fields from the datamodel, where the fields do not exist in the data. 

It's Splunk 7.3.4. I have run these two searches which give different results, which are even stranger.

| from datamodel:Performance.CPU
| head 1
| foreach * [ eval field_list=mvappend(field_list, "<<MATCHSTR>>") ]
| table field_list, * _raw
| from datamodel:Performance.CPU
| foreach * [ eval field_list=mvappend(field_list, "<<MATCHSTR>>") ]
| table field_list, * _raw
| head 1

The first one gives me field_list containing all the fields from the Performance.CPU data model, including the inherited ones, such as hypervisor_id, but which are null and are definitely not in the data, whereas the second one just gives me a smaller list of the non null fields in the data model. However, the _raw data is the same in both cases.

Does anyone know what * should mean when dealing with data models and should it work the same in both foreach and table cases.

 

Labels (2)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!