Where are the results of eval commands stored?

The eval command is a fundamental search processing command in Splunk used to calculate an expression. The result of this calculation is then assigned to a field, which can be either a new field created by the command or an existing field that is overwritten. This new or updated field exists within the context of the search results and can be used by subsequent commands in the search pipeline. The results are transient to the search job and are not permanently stored in a persistent data store like an index or KV Store by the eval command itself.

B. In an index. Indexes store raw and processed event data upon ingestion. The eval command operates on data retrieved from an index but does not write its results back to it.
C. In a KV Store. The KV Store is a lookup and application data repository. The eval command does not directly store its results in the KV Store.
D. In a database. The eval command's results are held in memory as part of the search results for the duration of the search, not in a separate database.

1. Splunk Enterprise Documentation

Search Reference

"eval" command page.

Section: Description

Content: "The eval command calculates an expression and puts the resulting value into a search results field. If the field name that you specify does not match a field name that is already in the events

a new field is added to the events. If the field name that you specify matches a field name that already exists in the events

the eval command overwrites the values in that field with the results of the expression." This directly confirms the result is stored in a field.

2. Splunk Education

Splunk Fundamentals 1

Course Manual.

Section: Module 6: Using the eval Command

Content: The course material explicitly teaches that the primary function of the eval command is to create a new field whose value is the result of a specified expression. For example

... | eval newfield = expression. This reinforces that the output destination is a field.