Splunk Search

Why am I yielding an error with Where Statement for exact numeric value?

blablabla
Path Finder

Hello,

I am experiencing an interesting Issue. I am trying to filter for a specific value in a numeric field. Following statement works finde:

 

 

 

 

index="IndexA" 
| eval A.distance=trim('A.distance',"'") 
| eval A.distance='A.distance'/100 
| search A.distance=1

 

 

 

 

If I am trying to replace the search with a where, I am getting the Error "Error in 'where' command: Type checking failed. The '==' operator received different types."

 

 

 

 

index="IndexA" 
| eval A.distance=trim('A.distance',"'") 
| eval A.distance='A.distance'/100 
| where A.distance=1

 

 

 

 

Event Coverage if this value is 100% and all the values get for typeof() the result "Number". All of the values do not have a digit after the comma. We are using Splunk Enterprise 8.2.3.3 . Does someone know, why the where statement is yielding an error in this case?

Thanks

Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try not to have special characters in field names - if you want to continue with them, put the field name in single quotes

| where 'A.distance'=1

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try not to have special characters in field names - if you want to continue with them, put the field name in single quotes

| where 'A.distance'=1
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...