Where are the results of eval commands stored?
https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Eval
The eval command calculates an expression and puts the resulting value into a search results field.
* If the field name that you specify does not match a field in the output, a new field is added to the search results.
* If the field name that you specify matches a field name that already exists in the search results, the results of the eval expression overwrite the values in that field.
Currently there are no comments in this discussion, be the first to comment!