Splunk Search

Why am I yielding an error with Where Statement for exact numeric value?

blablabla
Path Finder

Hello,

I am experiencing an interesting Issue. I am trying to filter for a specific value in a numeric field. Following statement works finde:

 

 

 

 

index="IndexA" 
| eval A.distance=trim('A.distance',"'") 
| eval A.distance='A.distance'/100 
| search A.distance=1

 

 

 

 

If I am trying to replace the search with a where, I am getting the Error "Error in 'where' command: Type checking failed. The '==' operator received different types."

 

 

 

 

index="IndexA" 
| eval A.distance=trim('A.distance',"'") 
| eval A.distance='A.distance'/100 
| where A.distance=1

 

 

 

 

Event Coverage if this value is 100% and all the values get for typeof() the result "Number". All of the values do not have a digit after the comma. We are using Splunk Enterprise 8.2.3.3 . Does someone know, why the where statement is yielding an error in this case?

Thanks

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try not to have special characters in field names - if you want to continue with them, put the field name in single quotes

| where 'A.distance'=1

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try not to have special characters in field names - if you want to continue with them, put the field name in single quotes

| where 'A.distance'=1
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...