Splunk Search

eval and where function - it does not work if there is a dot in the field name. do I need to escape the dot?

leonjxtan
Path Finder

because problem reported in link text

In my transaction data set DataModel1.RootTransaction1, now there is a "RootTransaction1.Extracted1" field.

I tried to run below query with "where" command (my use case does not allow me to use search command), and all do not work.

| from datamodel:DataModel1.RootTransaction1 |where RootTransaction1.Extracted1 = "abc"
| from datamodel:DataModel1.RootTransaction1 |where "RootTransaction1.Extracted1" = "abc"
| from datamodel:DataModel1.RootTransaction1 |where RootTransaction1\.Extracted1 = "abc"
| from datamodel:DataModel1.RootTransaction1 |where "RootTransaction1\.Extracted1" = "abc"

The only way working is to rename the field.

| from datamodel:DataModel1.RootTransaction1 |rename RootTransaction1.Extracted1 as Extracted1 |where Extracted1 = "abc"

but this is sub-optimal solution. How can I do eval and where with fields with dot in the middle?

Tags (1)
1 Solution

niketn
Legend

Put field name in single quotes to escape special character:

     | where 'RootTransaction1.Extracted1'="abc"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

javiergn
SplunkTrust
SplunkTrust

Hi,

I might be missing something but if I'm not mistaken when you run FROM you can simply reference the fields by using their short name and not the full name as you would have to do when using tstats for instance.

In your example, the following should just work fine:

| from datamodel:DataModel1.RootTransaction1  
|where Extracted1 = "abc"

And that might be the reason it's working fine when you use rename.
PS: when using field names from within an eval you have to use single quotes instead of double quotes if they contain special characters.

0 Karma

leonjxtan
Path Finder

sorry to add more background on why my use case cannot use search.

This is b/c I want to create an eval field from above Extracted1 field in data model UI, where I cannot rename the transaction field before I do eval...

The code I put in the eval field setting is like below:
case(RootTransaction1.Extracted1="abc", "xyz",
true(),""123")

0 Karma

niketn
Legend

Put field name in single quotes to escape special character:

     | where 'RootTransaction1.Extracted1'="abc"
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...