https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416287#M119826 <P>I am trying to create an error message based on a time frame, the last 15 min. and now. So the error message would say, </P> <P>"Client Missed file between 15:15:00 - 15:30:00"</P> <P>The times are calculated at the time of the search and the following search below fails as "Error in 'eval' command: Typechecking failed. '+' only takes two strings or two numbers."</P> <P>| eval 15MinEarly=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") <BR /> | eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")<BR /> | eval ErrorMessage = "Client Missed file between: " + 15MinEarly + " - " Now</P> <P>How do you convert the two times to string so I can concatenate them into the error message?</P> Mon, 20 Aug 2018 20:15:36 GMT griffinpair 2018-08-20T20:15:36Z https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416287#M119826 <P>I am trying to create an error message based on a time frame, the last 15 min. and now. So the error message would say, </P> <P>"Client Missed file between 15:15:00 - 15:30:00"</P> <P>The times are calculated at the time of the search and the following search below fails as "Error in 'eval' command: Typechecking failed. '+' only takes two strings or two numbers."</P> <P>| eval 15MinEarly=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") <BR /> | eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")<BR /> | eval ErrorMessage = "Client Missed file between: " + 15MinEarly + " - " Now</P> <P>How do you convert the two times to string so I can concatenate them into the error message?</P> Mon, 20 Aug 2018 20:15:36 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416287#M119826 griffinpair 2018-08-20T20:15:36Z https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416288#M119827 <P>Use . for concatenation of strings</P> <PRE> | eval 15MinEarly=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") | eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S") | eval ErrorMessage = "Client Missed file between: " .15MinEarly ." - ".Now </PRE> Mon, 20 Aug 2018 20:22:43 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416288#M119827 pradeepkumarg 2018-08-20T20:22:43Z https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416289#M119828 <P>I got the following error:</P> <P>⚠ Error in 'eval' command: The expression is malformed. </P> Tue, 21 Aug 2018 13:53:10 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416289#M119828 griffinpair 2018-08-21T13:53:10Z https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416290#M119829 <P>are your fields 15MinEarly and Now working? try <PRE>| table 15MinEarly Now</PRE></P> Tue, 21 Aug 2018 14:04:46 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416290#M119829 pradeepkumarg 2018-08-21T14:04:46Z https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416291#M119830 <P>Yes. Both fields return expected values.</P> Tue, 21 Aug 2018 14:36:31 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416291#M119830 griffinpair 2018-08-21T14:36:31Z https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416292#M119831 <P>@griffinpair,</P> <P>Is it ok for you to change the variable name from <CODE>15MinEarly</CODE> to <CODE>MinEarly_15</CODE>? Also change your search to add <CODE>+</CODE> to the last "Now"</P> <PRE><CODE>| eval MinEarly_15=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") | eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S") | eval ErrorMessage = "Client Missed file between: " + MinEarly_15 + " - " + Now </CODE></PRE> <P>Looks like splunk is bit confused to see the variables starting with digits <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 21 Aug 2018 14:57:27 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416292#M119831 renjith_nair 2018-08-21T14:57:27Z https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416293#M119832 <P>That was exactly the problem. Thanks so much!</P> Tue, 21 Aug 2018 15:03:27 GMT https://community.splunk.com/t5/Splunk-Search/Adding-a-date-to-a-string-Message/m-p/416293#M119832 griffinpair 2018-08-21T15:03:27Z