Splunk Search

Why doesn't this eval statement work?

dbcase
Motivator

Hi,

I have this query

index=wholesale_app buildTarget=comcast analyticType=SessionStart   |rename Properties.platformData.HC as hc|rename Properties.platformData.HM as hm|eval hardwaretype=hc+hm|table hardwaretype hc hm

Why won't the eval....well eval?

I've also tried this

index=wholesale_app buildTarget=comcast analyticType=SessionStart   |rename Properties.platformData.HC as hc|rename Properties.platformData.HM as hm|eval hardwaretype=hc+" "+hm|table hardwaretype hc hm

and this

index=wholesale_app buildTarget=comcast analyticType=SessionStart   |rename Properties.platformData.HC as hc|rename Properties.platformData.HM as hm|eval hardwaretype='hc'+" "+'hm'|table hardwaretype hc hm

the resulting table shows values for hc and hm but no values for hardwaretype

Tags (2)
0 Karma

niketn
Legend

@dbcase, We would like to know what is not working with eval, can you put the tabular output of your search preferably the following?

index=wholesale_app buildTarget=comcast analyticType=SessionStart    |rename Properties.platformData.HC as hc|rename Properties.platformData.HM as hm|eval hardwaretype=hc+" "+hm|table hardwaretype hc hm
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

mtulett_splunk
Splunk Employee
Splunk Employee

If both fields are strings, you can use strcat instead, which is a bit simpler to work with. Replace your eval command with:

| strcat hc " " hm hardwaretype

This will create a new field "hardwaretype" with your two strings and a space in between.

Without knowing what your fields have in them, I worry that eval is attempting to sum your fields, rather than concatenate them. If you want to use eval specifically, you can try using periods instead of plus signs - this is the preferred format for joining text:

| eval hardwaretype=hm." ".hc

Or even:

| eval hardwaretype=tostring(hm)." ".tostring(hc)
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...