Splunk Search

Why am I yielding an error with Where Statement for exact numeric value?

blablabla
Path Finder

Hello,

I am experiencing an interesting Issue. I am trying to filter for a specific value in a numeric field. Following statement works finde:

 

 

 

 

index="IndexA" 
| eval A.distance=trim('A.distance',"'") 
| eval A.distance='A.distance'/100 
| search A.distance=1

 

 

 

 

If I am trying to replace the search with a where, I am getting the Error "Error in 'where' command: Type checking failed. The '==' operator received different types."

 

 

 

 

index="IndexA" 
| eval A.distance=trim('A.distance',"'") 
| eval A.distance='A.distance'/100 
| where A.distance=1

 

 

 

 

Event Coverage if this value is 100% and all the values get for typeof() the result "Number". All of the values do not have a digit after the comma. We are using Splunk Enterprise 8.2.3.3 . Does someone know, why the where statement is yielding an error in this case?

Thanks

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try not to have special characters in field names - if you want to continue with them, put the field name in single quotes

| where 'A.distance'=1

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try not to have special characters in field names - if you want to continue with them, put the field name in single quotes

| where 'A.distance'=1
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...