Splunk Search

eval and where function - it does not work if there is a dot in the field name. do I need to escape the dot?

leonjxtan
Path Finder

because problem reported in link text

In my transaction data set DataModel1.RootTransaction1, now there is a "RootTransaction1.Extracted1" field.

I tried to run below query with "where" command (my use case does not allow me to use search command), and all do not work.

| from datamodel:DataModel1.RootTransaction1 |where RootTransaction1.Extracted1 = "abc"
| from datamodel:DataModel1.RootTransaction1 |where "RootTransaction1.Extracted1" = "abc"
| from datamodel:DataModel1.RootTransaction1 |where RootTransaction1\.Extracted1 = "abc"
| from datamodel:DataModel1.RootTransaction1 |where "RootTransaction1\.Extracted1" = "abc"

The only way working is to rename the field.

| from datamodel:DataModel1.RootTransaction1 |rename RootTransaction1.Extracted1 as Extracted1 |where Extracted1 = "abc"

but this is sub-optimal solution. How can I do eval and where with fields with dot in the middle?

Tags (1)
1 Solution

niketn
Legend

Put field name in single quotes to escape special character:

     | where 'RootTransaction1.Extracted1'="abc"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

javiergn
Super Champion

Hi,

I might be missing something but if I'm not mistaken when you run FROM you can simply reference the fields by using their short name and not the full name as you would have to do when using tstats for instance.

In your example, the following should just work fine:

| from datamodel:DataModel1.RootTransaction1  
|where Extracted1 = "abc"

And that might be the reason it's working fine when you use rename.
PS: when using field names from within an eval you have to use single quotes instead of double quotes if they contain special characters.

0 Karma

leonjxtan
Path Finder

sorry to add more background on why my use case cannot use search.

This is b/c I want to create an eval field from above Extracted1 field in data model UI, where I cannot rename the transaction field before I do eval...

The code I put in the eval field setting is like below:
case(RootTransaction1.Extracted1="abc", "xyz",
true(),""123")

0 Karma

niketn
Legend

Put field name in single quotes to escape special character:

     | where 'RootTransaction1.Extracted1'="abc"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...