I get number from subsearch but get null for string like below on splunk 8.1.4.
I found the splunk answer that resolved by appending "format", but it is not resolved for me. Is it bug on 8.x?
| makeresults
| eval foo = [ | makeresults | eval foo="123" | return $foo ]
| eval bar = [ | makeresults | eval bar="bar" | return $bar ]
| eval baz = tostring([ | makeresults | eval baz="baz" | return $baz ])
| eval qux = tostring([ | makeresults | eval qux="qux" | return $qux | format ])
| table _time foo bar baz qux
If you expand the query (<ctrl><shift>E) you get this
| makeresults
| eval foo = 123
| eval bar = bar
| eval baz = tostring( baz )
| eval qux = tostring( ( ( qux ) ) )
| table _time foo bar baz qux
Which explains all the null and empty fields
You can (almost) fix this by providing arguments to the format command - the result (if not numeric) still needs trimming
| makeresults
| eval foo = [ | makeresults | eval foo="123" | return $foo ]
| eval bar = trim([ | makeresults | eval bar="bar" | return $bar | format "\"" "" "" "" "" "\"" ])
| eval baz = tostring(trim([ | makeresults | eval baz="baz" | return $baz | format "\"" "" "" "" "" "\"" ]))
| eval qux = tostring(trim([ | makeresults | eval qux="qux" | return $qux | format "" "\"" "" "\"" "" "" ]))
| table _time foo bar baz qux
Giving
If you expand the query (<ctrl><shift>E) you get this
| makeresults
| eval foo = 123
| eval bar = bar
| eval baz = tostring( baz )
| eval qux = tostring( ( ( qux ) ) )
| table _time foo bar baz qux
Which explains all the null and empty fields
You can (almost) fix this by providing arguments to the format command - the result (if not numeric) still needs trimming
| makeresults
| eval foo = [ | makeresults | eval foo="123" | return $foo ]
| eval bar = trim([ | makeresults | eval bar="bar" | return $bar | format "\"" "" "" "" "" "\"" ])
| eval baz = tostring(trim([ | makeresults | eval baz="baz" | return $baz | format "\"" "" "" "" "" "\"" ]))
| eval qux = tostring(trim([ | makeresults | eval qux="qux" | return $qux | format "" "\"" "" "\"" "" "" ]))
| table _time foo bar baz qux
Giving
Wow! Thank you very much for quick and perfect answer! It works fine!