Splunk Search

trying to understand the where clause better + can spaces be in the variable name used for the where clause

HattrickNZ
Motivator

my query looks like

stats max(KPI1) as "Traffic of Sessions Answered (Erl)" max(KPI2) as "Traffic of Sessions Connected (Erl)" max(c1907466993) as "Traffic of Sessions Seized (Erl)" by SBC_TGN_TGID | where "Traffic of Sessions Answered (Erl)" > 0

but this does not work, get an error, as it does not seem to like this naming format "Traffic of Sessions Answered (Erl)"

But if i do it like below it works, i get a table with no Zeron values.

stats max(KPI1) as "Traffic" max(KPI2) as "Traffic of Sessions Connected (Erl)" max(KPI3) as "Traffic of Sessions Seized (Erl)" by SBC_TGN_TGID | where Traffic > 0

So it likes this: where Traffic > 0

But it will not like this: where Traffic > 0

It basically does not like names that are inside double quotes.

Can someone explain this to me? And is there a way I can keep the name as it is (i.e. with spaces)

Tags (2)
0 Karma
1 Solution

HattrickNZ
Motivator

I have to use single quotes to get it to work

| where 'Traffic of Sessions Answered' > 0

View solution in original post

woodcock
Esteemed Legend

You can also use dollar signs:

| where $Traffic of Sessions Answered$ > 0

HattrickNZ
Motivator

I have to use single quotes to get it to work

| where 'Traffic of Sessions Answered' > 0

MuS
Legend

exactly 😉

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...