Splunk Search

Dataset regexed field to uppercase

christoffertoft
Communicator

Hello.

I have a dataset with a regular expression where i extract the hostname of the computer to a hostname variable.

However, in the searches i base this on, a lower case hostname does not work.
How can I add a simple eval to the dataset that does | eval hostname=upper(hostname) ?

(The error I get when i try to do this in the GUI is Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

That error is what you get when a subsearch returns no values.

If you show us the actual search where you are trying to use it, we can help debug what is occurring.

0 Karma

christoffertoft
Communicator

the base event is just a regular cookie-cutter index=abc sourcetype=defg
There are a number of auto extracted fields in the data set, and one regular expression which extracts the hostname from a certain field in the dataset. The hostname is typed manually and sometimes is input in lowercase. When the field is extracted and additional logic is applied to the lowercase hostname, things break.

So the search is kind of irrelevant, since apparently I cant do |eval hostname=upper(hostname) in the web gui for the data set, no matter what type of field extraction I choose.

0 Karma

niketn
Legend

@christoffertoft can you add some sample data and also your query?

If you are using where and lowercase hostname does not work can you replace where with search which should do case insensitive match.

Ideally, | eval hostname=upper(hostname) should work. Refer to following run anywhere search.

|  makeresults
|  eval hostname="abc123"
|  eval hostname=upper(hostname)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

christoffertoft
Communicator

I know, this is not a question about whether it works or not, it's just that it cant do it in the dataset in the GUI.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...