Splunk Search

sub search does not return string on splunk 8.1.4

kiyoshi_miyake
Explorer

I get number from subsearch but get null for string like below on splunk 8.1.4.
I found the splunk answer that resolved by appending "format", but it is not resolved for me. Is it bug on 8.x?

subsearch_issue.PNG

| makeresults
| eval foo = [ | makeresults | eval foo="123" | return $foo ]
| eval bar = [ | makeresults | eval bar="bar" | return $bar ]
| eval baz = tostring([ | makeresults | eval baz="baz" | return $baz ])
| eval qux = tostring([ | makeresults | eval qux="qux" | return $qux | format ])
| table _time foo bar baz qux

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

If you expand the query (<ctrl><shift>E) you get this

| makeresults 
| eval foo = 123 
| eval bar = bar 
| eval baz = tostring( baz ) 
| eval qux = tostring( ( ( qux ) ) ) 
| table _time foo bar baz qux

Which explains all the null and empty fields

You can (almost) fix this by providing arguments to the format command - the result (if not numeric) still needs trimming

| makeresults
| eval foo = [ | makeresults | eval foo="123" | return $foo ]
| eval bar = trim([ | makeresults | eval bar="bar" | return $bar | format "\"" "" "" "" "" "\"" ])
| eval baz = tostring(trim([ | makeresults | eval baz="baz" | return $baz | format "\"" "" "" "" "" "\"" ]))
| eval qux = tostring(trim([ | makeresults | eval qux="qux" | return $qux | format "" "\"" "" "\"" "" "" ]))
| table _time foo bar baz qux

Giving

ITWhisperer_0-1643280109814.pngITWhisperer_1-1643280151197.png

 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

If you expand the query (<ctrl><shift>E) you get this

| makeresults 
| eval foo = 123 
| eval bar = bar 
| eval baz = tostring( baz ) 
| eval qux = tostring( ( ( qux ) ) ) 
| table _time foo bar baz qux

Which explains all the null and empty fields

You can (almost) fix this by providing arguments to the format command - the result (if not numeric) still needs trimming

| makeresults
| eval foo = [ | makeresults | eval foo="123" | return $foo ]
| eval bar = trim([ | makeresults | eval bar="bar" | return $bar | format "\"" "" "" "" "" "\"" ])
| eval baz = tostring(trim([ | makeresults | eval baz="baz" | return $baz | format "\"" "" "" "" "" "\"" ]))
| eval qux = tostring(trim([ | makeresults | eval qux="qux" | return $qux | format "" "\"" "" "\"" "" "" ]))
| table _time foo bar baz qux

Giving

ITWhisperer_0-1643280109814.pngITWhisperer_1-1643280151197.png

 

kiyoshi_miyake
Explorer

Wow! Thank you very much for quick and perfect answer! It works fine!

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...