Splunk Search

Why doesn't this eval statement work?

dbcase
Motivator

Hi,

I have this query

index=wholesale_app buildTarget=comcast analyticType=SessionStart   |rename Properties.platformData.HC as hc|rename Properties.platformData.HM as hm|eval hardwaretype=hc+hm|table hardwaretype hc hm

Why won't the eval....well eval?

I've also tried this

index=wholesale_app buildTarget=comcast analyticType=SessionStart   |rename Properties.platformData.HC as hc|rename Properties.platformData.HM as hm|eval hardwaretype=hc+" "+hm|table hardwaretype hc hm

and this

index=wholesale_app buildTarget=comcast analyticType=SessionStart   |rename Properties.platformData.HC as hc|rename Properties.platformData.HM as hm|eval hardwaretype='hc'+" "+'hm'|table hardwaretype hc hm

the resulting table shows values for hc and hm but no values for hardwaretype

Tags (2)
0 Karma

niketn
Legend

@dbcase, We would like to know what is not working with eval, can you put the tabular output of your search preferably the following?

index=wholesale_app buildTarget=comcast analyticType=SessionStart    |rename Properties.platformData.HC as hc|rename Properties.platformData.HM as hm|eval hardwaretype=hc+" "+hm|table hardwaretype hc hm
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mtulett_splunk
Splunk Employee
Splunk Employee

If both fields are strings, you can use strcat instead, which is a bit simpler to work with. Replace your eval command with:

| strcat hc " " hm hardwaretype

This will create a new field "hardwaretype" with your two strings and a space in between.

Without knowing what your fields have in them, I worry that eval is attempting to sum your fields, rather than concatenate them. If you want to use eval specifically, you can try using periods instead of plus signs - this is the preferred format for joining text:

| eval hardwaretype=hm." ".hc

Or even:

| eval hardwaretype=tostring(hm)." ".tostring(hc)
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...