topic Re: How to give a time value to a field with eval command? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-give-a-time-value-to-a-field-with-eval-command/m-p/395589#M114871 <P>I'd suggest using <CODE>now()</CODE> instead of <CODE>_time</CODE>.</P> Tue, 19 Jun 2018 07:20:52 GMT FrankVl 2018-06-19T07:20:52Z How to give a time value to a field with eval command? https://community.splunk.com/t5/Splunk-Search/How-to-give-a-time-value-to-a-field-with-eval-command/m-p/395587#M114869 <P>Hey <BR /> I want to create a field with a time value using following commend</P> <PRE><CODE>| inputlookup task_time_worked.csv | eval deadline=-1week@week </CODE></PRE> <P>System throw me an error</P> <PRE><CODE>"Error in 'eval' command: The expression is malformed. " </CODE></PRE> <P>Any suggestion of what is the right way to write this spl?<BR /> Thanks in advance<BR /> Regards</P> Tue, 19 Jun 2018 01:22:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-give-a-time-value-to-a-field-with-eval-command/m-p/395587#M114869 samlinsongguo 2018-06-19T01:22:59Z Re: How to give a time value to a field with eval command? https://community.splunk.com/t5/Splunk-Search/How-to-give-a-time-value-to-a-field-with-eval-command/m-p/395588#M114870 <P>Try this: <CODE>| eval deadline= relative_time(_time, "-1w@w1") | convert ctime(deadline)</CODE></P> Tue, 19 Jun 2018 02:53:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-give-a-time-value-to-a-field-with-eval-command/m-p/395588#M114870 amiftah 2018-06-19T02:53:54Z Re: How to give a time value to a field with eval command? https://community.splunk.com/t5/Splunk-Search/How-to-give-a-time-value-to-a-field-with-eval-command/m-p/395589#M114871 <P>I'd suggest using <CODE>now()</CODE> instead of <CODE>_time</CODE>.</P> Tue, 19 Jun 2018 07:20:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-give-a-time-value-to-a-field-with-eval-command/m-p/395589#M114871 FrankVl 2018-06-19T07:20:52Z Re: How to give a time value to a field with eval command? https://community.splunk.com/t5/Splunk-Search/How-to-give-a-time-value-to-a-field-with-eval-command/m-p/395590#M114872 <P>thank you for your help</P> Tue, 19 Jun 2018 08:42:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-give-a-time-value-to-a-field-with-eval-command/m-p/395590#M114872 samlinsongguo 2018-06-19T08:42:59Z