Splunk Search

Why can't I search field values created in eval?

michaeler
Communicator

I have a field called "Node_ID" that I extracted from another field "issue" that is formatted as N1234. There were some events that didn't fit and couldn't extract normally so I used eval to identify them.

| eval Node_ID=if(like(issue, "WC SVR%"), "WC SVR", Node_ID), Node_ID=if(like(issue, "EU SVR%"), "EU SVR", Node_ID), Node_ID=if(like(issue, "SE SVR%"), "SE SVR", Node_ID), Node_ID=if(like(issue, "NE SVR%"), "NE SVR", Node_ID)

This does what I want and adds those values to the field Node_ID but when I try to search by one of them:

| search Node_ID="WC SVR"

I get zero results even though I can see there are 4 events when looking at the field in the sidebar. Is there a reason behind this?

** Any suggestions to do this another way are always appreciated**

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Looks like a bug - try like this:

| eval Node_ID=if(like(issue, "WC SVR%"), "WC SVR", Node_ID)
| eval Node_ID=if(like(issue, "EU SVR%"), "EU SVR", Node_ID)
| eval Node_ID=if(like(issue, "SE SVR%"), "SE SVR", Node_ID)
| eval Node_ID=if(like(issue, "NE SVR%"), "NE SVR", Node_ID)
| where Node_ID=="WC SVR"

or this

| eval Node_ID=case(like(issue, "WC SVR%"), "WC SVR", like(issue, "EU SVR%"), "EU SVR", like(issue, "SE SVR%"), "SE SVR", like(issue, "NE SVR%"), "NE SVR") 
| search Node_ID="WC SVR"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...