Splunk Search

Strange foreach behaviour with wildcards

bowesmana
SplunkTrust
SplunkTrust

We all know that foreach * will work on all the fields in the result row right...

Well it seems that when using datamodels, the wildcard for fields is not what it seems

 

| from datamodel:DataModelName
| foreach * [ eval field_list=mvappend(field_list, "<<MATCHSTR>>") ]
| table field_list, * _raw

 

With the above running on a suitably populated data model, the wildcard in the foreach and the one in the table statement give a different set of fields - but not always.

The foreach * will normally show the data seen in the backing event mapped onto the data model, whereas the table * will show the datamodel fields names, even if those fields are null.

However, I have run searches today, where the foreach statement is actually getting fields from the datamodel, where the fields do not exist in the data. 

It's Splunk 7.3.4. I have run these two searches which give different results, which are even stranger.

| from datamodel:Performance.CPU
| head 1
| foreach * [ eval field_list=mvappend(field_list, "<<MATCHSTR>>") ]
| table field_list, * _raw
| from datamodel:Performance.CPU
| foreach * [ eval field_list=mvappend(field_list, "<<MATCHSTR>>") ]
| table field_list, * _raw
| head 1

The first one gives me field_list containing all the fields from the Performance.CPU data model, including the inherited ones, such as hypervisor_id, but which are null and are definitely not in the data, whereas the second one just gives me a smaller list of the non null fields in the data model. However, the _raw data is the same in both cases.

Does anyone know what * should mean when dealing with data models and should it work the same in both foreach and table cases.

 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...