Splunk Search

cannot eval a field obtained from rex and i am pretty sure the field is only digits

Path Finder

I cannot seem to "eval" a field obtained from a "rex" and i am pretty sure the field is only digits... this is similiar to http://splunk-base.splunk.com/answers/45605/cannot-eval-a-field-obtained-from-rex, which i already reviewed

here is the search: "Latency:" | rex "Latency:\s*(?P<fsprhr>\d+)" | eval fsprhr=1

here is an example of the data returned by the search, regardless of whether the search is "Latency:" or "Latency:" | rex "Latency:\s*(?P<fsprhr>\d+)" or "Latency:" | rex "Latency:\s*(?P<fsprhr>\d+)" | eval fsprhr=1:

<?xml version='1.0' encoding='utf-8'?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><log-entry serial='201360' domain='SANDBOX'><date>20121214</date><time utc='1355497924621'>151204</time><date-time>2012-12-14T10:12:04</date-time><type>latency</type><class>xmlfirewall</class><object>xmiStats</object><level num='6'>info</level><transaction-type></transaction-type><transaction>9607650</transaction><client>10.70.50.223</client><code>0x80e00073</code><file></file><message>Latency: 0 0 0 0 519 493 1 519 0 0 0 519 0 0 0 0 [http://emsadp07mgt:2066/xmiStats]</message></log-entry></SOAP-ENV:Body></SOAP-ENV:Envelope>

the data above is in XML format and is not displaying properly and i do not enough karma to upload a screenshot...

Tags (3)
0 Karma
1 Solution

Path Finder

I'm not sure what you are trying to do here. What do you mean you cannot "eval" a field that has been extracted with Rex. Eval creates a new field based on evaluating something. You are simply assigning to a field that has the same name as the extracted field.

Does the following work?

| eval newfield=fsprhr

What are you trying to do with Eval?

View solution in original post

Path Finder

I'm not sure what you are trying to do here. What do you mean you cannot "eval" a field that has been extracted with Rex. Eval creates a new field based on evaluating something. You are simply assigning to a field that has the same name as the extracted field.

Does the following work?

| eval newfield=fsprhr

What are you trying to do with Eval?

View solution in original post

Path Finder

I was trying to check whether or not the fsprhr field had a value of 1...

0 Karma

Splunk Employee
Splunk Employee

try to convert to numerical with |convert num(myfield)

0 Karma