Splunk Search

Why does the query only work in eval and not fieldformat?

dbcase
Motivator

Hi,

I have this query. If I change fieldformat to eval the query works but if it is left as fieldformat the query returns no results. First time I'm trying to use fieldformat so I don't quite understand what I'm missing.

earliest=-24h index=wholesale_app buildTarget=* product=* CustomAnalytic Properties.index=17 OR Properties.index=19 OR Properties.index=21 OR Properties.index=23 OR (Properties.index=>25 AND Properties.index<=32) buildTarget=* product=* |rename Properties.index as pindex|fieldformat pindextype=case(pindex == "17", "CVR Event Selected", pindex == "19", "CVR Fetch Events",pindex == "21", "CVR Event View Ended", pindex == "23", "CVR Play Pressed",pindex == "25", "CVR Pause Pressed", pindex == "26", "CVR Landscape Orientation",pindex == "27", "CVR Portrait Orientation", pindex == "28", "CVR Jump Forward", pindex == "29", "CVR Jump Back", pindex == "30", "CVR Video Session Started", pindex == "31", "CVR Video Error", pindex == "32", "CVR Range Set")|stats count by pindextype
0 Karma
1 Solution

somesoni2
Revered Legend

The function fieldformat is used to change the format of "existing" field without changing underlying value. Here the field pindextype doesn't exist hence can't be used with fieldformat command. You've to either use eval itself OR use fieldformat with existing field "pindex"

View solution in original post

0 Karma

somesoni2
Revered Legend

The function fieldformat is used to change the format of "existing" field without changing underlying value. Here the field pindextype doesn't exist hence can't be used with fieldformat command. You've to either use eval itself OR use fieldformat with existing field "pindex"

0 Karma

somesoni2
Revered Legend

Of course, your last stats command would change too if you plan to use existing field pindex.

0 Karma

dbcase
Motivator

Ahhhhh thats what I missed ... EXISTING field, now it makes sense

Thanks Somesoni2! (again)

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...