topic Can anyone tell me why Splunk is throwing this error when using the foreach command? in Splunk Search

Can anyone tell me why Splunk is throwing this error when using the foreach command?

nkankur — Fri, 03 Nov 2017 08:05:45 GMT

| foreach V* [eval PAC<<MATCHSTR>>=<<FIELD>>-Voice], 
| foreach PAC* [eval <<FIELD>>=if(<<FIELD>> < 0, -<<FIELD>>, 0)]

error -> Error in 'foreach' command: Only the last argument should be a search pipeline

Re: Can anyone tell me why Splunk is throwing this error when using the foreach command?

horsefez — Fri, 03 Nov 2017 08:54:57 GMT

Hi nkankur,
I see an odd "," at the end of the first foreach statement... sure this needs to be there?

Re: Can anyone tell me why Splunk is throwing this error when using the foreach command?

koshyk — Fri, 03 Nov 2017 09:56:09 GMT

I can find 3 issues in above query.

there is a comma , in your first line end. That's is wrong
the string -voice should be concatenated to field using . " (dot and double quotes) to make it a string.
the PAC value is doing if based on a numeric value, but you have concatenated with a string. This might give unexpected results

Please find corrected query

|makeresults | eval total=0| eval VariableA="100"| eval VariableB="200"
| foreach V* [eval PAC_<<MATCHSTR>>=<<FIELD>> . "-voice" ]  
| foreach PAC* [eval <<FIELD>>=if(<<FIELD>> < 0, -<<FIELD>>, 0)]