eval not matching value from Data model

[snemiro_514]

Im rewritting a dashboard using data models. So far so good, but I'm stuck at this point where I need to redefine two new fields and the eval command is not matching the result.

My data model has a child object field TEST.status with values SUCCESS and ERROR.

In my previous chart, direct from the index I had:

search index | chart count as "#", count(eval(status=SUCCESS)) as Good, count(eval(status!=SUCCESS)) as ERR

which works, showing a table with count of total events, count of success and count of errors

Now, using my TEST object I'm doing the same thing, replacing the status by TEST.status, but it shows 0 counts.

| datamodel DM1 TEST search | chart count as "#", count(eval(TEST.status="SUCCESS)) as Good

The values are the same.... what could be wrong??

If I do a
| chart count by TEST.status

I have both values (SUCCESS, ERROR) listed with the proper number of events.

Thanks!

[martin_mueller · Accepted solution]

Enclose the field name in single quotes: eval('TEST.status'="SUCCESS")

The dot in the field name is treated by eval as the concatenation operator, adding the (non-existent) strings in TEST and status together, just like having a field named foo-bar will cause a subtraction to happen. The single quote tells eval to not do that.

Your chart example works because it doesn't attempt to apply any operators, it just treats the whole string as a field name right away.