The eval statement works if I run a simple query such as:
*|eval n2=1+somefield|fields n2
But when I have it in the following query, which is what we are trying to achieve here, it does not give what we expected
A="V1" B="*" C="*" | eval D_hex="0x46475250"+"00000014" | eval D_incorrect=tonumber(D_hex,16) | eval D_dec=20+D_incorrect | fields D_dec D_incorrect
Both “SPAR_dec_incorrect” and “SPAR_dec” gives the same value.
Anyone?