Splunk Search

sub search does not return string on splunk 8.1.4

kiyoshi_miyake
Explorer

I get number from subsearch but get null for string like below on splunk 8.1.4.
I found the splunk answer that resolved by appending "format", but it is not resolved for me. Is it bug on 8.x?

subsearch_issue.PNG

| makeresults
| eval foo = [ | makeresults | eval foo="123" | return $foo ]
| eval bar = [ | makeresults | eval bar="bar" | return $bar ]
| eval baz = tostring([ | makeresults | eval baz="baz" | return $baz ])
| eval qux = tostring([ | makeresults | eval qux="qux" | return $qux | format ])
| table _time foo bar baz qux

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If you expand the query (<ctrl><shift>E) you get this

| makeresults 
| eval foo = 123 
| eval bar = bar 
| eval baz = tostring( baz ) 
| eval qux = tostring( ( ( qux ) ) ) 
| table _time foo bar baz qux

Which explains all the null and empty fields

You can (almost) fix this by providing arguments to the format command - the result (if not numeric) still needs trimming

| makeresults
| eval foo = [ | makeresults | eval foo="123" | return $foo ]
| eval bar = trim([ | makeresults | eval bar="bar" | return $bar | format "\"" "" "" "" "" "\"" ])
| eval baz = tostring(trim([ | makeresults | eval baz="baz" | return $baz | format "\"" "" "" "" "" "\"" ]))
| eval qux = tostring(trim([ | makeresults | eval qux="qux" | return $qux | format "" "\"" "" "\"" "" "" ]))
| table _time foo bar baz qux

Giving

ITWhisperer_0-1643280109814.pngITWhisperer_1-1643280151197.png

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

If you expand the query (<ctrl><shift>E) you get this

| makeresults 
| eval foo = 123 
| eval bar = bar 
| eval baz = tostring( baz ) 
| eval qux = tostring( ( ( qux ) ) ) 
| table _time foo bar baz qux

Which explains all the null and empty fields

You can (almost) fix this by providing arguments to the format command - the result (if not numeric) still needs trimming

| makeresults
| eval foo = [ | makeresults | eval foo="123" | return $foo ]
| eval bar = trim([ | makeresults | eval bar="bar" | return $bar | format "\"" "" "" "" "" "\"" ])
| eval baz = tostring(trim([ | makeresults | eval baz="baz" | return $baz | format "\"" "" "" "" "" "\"" ]))
| eval qux = tostring(trim([ | makeresults | eval qux="qux" | return $qux | format "" "\"" "" "\"" "" "" ]))
| table _time foo bar baz qux

Giving

ITWhisperer_0-1643280109814.pngITWhisperer_1-1643280151197.png

 

kiyoshi_miyake
Explorer

Wow! Thank you very much for quick and perfect answer! It works fine!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...