I tried doing the following and got back nothing:
sourcetype=json | transaction 'LogEntry.Content.SvctagSegmentGrp.DpsNum'
but had no results. However, when I do the following, I get the expected results:
sourcetype=json | eval DispatchNumber='LogEntry.Content.SvctagSegmentGrp.DpsNum' | transaction DispatchNumber
Has anyone encountered this issue?
Remove the single-quotes from your field name:
sourcetype=json | transaction LogEntry.Content.SvctagSegmentGrp.DpsNum
Remove the single-quotes from your field name:
sourcetype=json | transaction LogEntry.Content.SvctagSegmentGrp.DpsNum
OK, that worked for transaction, but when I do something like strptime, I need the single quotes. Is there some scorecard indicating when and when not?
eval TimeOpen = now() - strptime(LogEntry.Content.StatusSegmentGrp.StatusDate, "%a %b %d %H:%M:%S %Z %Y") - Does not Work
eval TimeOpen = now() - strptime('LogEntry.Content.StatusSegmentGrp.StatusDate', "%a %b %d %H:%M:%S %Z %Y") - Works
transaction LogEntry.Content.StatusSegmentGrp.StatusDate - Works
transaction 'LogEntry.Content.StatusSegmentGrp.StatusDate' - Does not Work
Based on your two scenarios, it would appear that you need them when you're passing the field name to an eval
function (like strptime
), but not in the case where it's just an argument to a command (like transaction
).
I would have thought so as well, however, when passing a field to a macro it only works with no single quotes. I think that there really needs to be a scorecard or some uniformity.
...many years later... I thought I would just add, I've seen similar symptoms, renaming your field before using it in eval and I believe a few other commands will keep it consistent for you.