Im rewritting a dashboard using data models. So far so good, but I'm stuck at this point where I need to redefine two new fields and the eval command is not matching the result.
My data model has a child object field TEST.status with values SUCCESS and ERROR.
In my previous chart, direct from the index I had:
search index | chart count as "#", count(eval(status=SUCCESS)) as Good, count(eval(status!=SUCCESS)) as ERR
which works, showing a table with count of total events, count of success and count of errors
Now, using my TEST object I'm doing the same thing, replacing the status by TEST.status, but it shows 0 counts.
| datamodel DM1 TEST search | chart count as "#", count(eval(TEST.status="SUCCESS)) as Good
The values are the same.... what could be wrong??
If I do a
| chart count by TEST.status
I have both values (SUCCESS, ERROR) listed with the proper number of events.
Thanks!
Enclose the field name in single quotes: eval('TEST.status'="SUCCESS")
The dot in the field name is treated by eval
as the concatenation operator, adding the (non-existent) strings in TEST
and status
together, just like having a field named foo-bar
will cause a subtraction to happen. The single quote tells eval
to not do that.
Your chart
example works because it doesn't attempt to apply any operators, it just treats the whole string as a field name right away.
Enclose the field name in single quotes: eval('TEST.status'="SUCCESS")
The dot in the field name is treated by eval
as the concatenation operator, adding the (non-existent) strings in TEST
and status
together, just like having a field named foo-bar
will cause a subtraction to happen. The single quote tells eval
to not do that.
Your chart
example works because it doesn't attempt to apply any operators, it just treats the whole string as a field name right away.