https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-Command/m-p/63066#M15570 <P>I am trying to combine 3 separate searches into one.</P> <P>The first search begins within sourcetype=pan:traffic. I use the src_translated_port and src_translated_ip to return the src_ip that I am looking for.</P> <P>I then want to match that src_ip to the dest_ip within sourcetype=msdhcp, which is currently my second search. I use this search to return the dest_mac that I am looking for.</P> <P>The third search is within sourcetype=campusmgr. I want to match the dest_mac returned from sourcetype=msdhcp to the src_mac with sourcetype=campusmgr.</P> Mon, 28 Sep 2020 13:31:32 GMT KNichol5hd 2020-09-28T13:31:32Z https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-Command/m-p/63062#M15566 <P>sourcetype=campusmgr earliest=-72h latest=+72h [search sourcetype=msdhcp earliest=03/10/2013:12:40:00 latest=03/10/2013:15:40:00 | eval dest_ip=if (match(sourcetype,"pan:traffic"),src_ip,"") [search sourcetype=pan:traffic src_translated_port=##### src_translated_ip=###.###.##.## earliest=03/10/2013:12:40:00 latest=03/10/2013:15:40:00 | return 10 src_ip] | return 10 dest_ip] | chart count by user | sort - count</P> <P>Error in 'eval' command: The operator at '(src_ip="###.###.##.##") OR (src_ip="###.###.##.##") OR (src_ip="###.###.##.##") OR (src_ip="###.###.##.##")' is invalid.</P> <P>Can anyone tell me what I'm doing wrong here?</P> <P>*The sourcetype=src_ip in pan:traffic appears as dest_ip in sourcetype=msdhcp.<BR /> *The dest_mac in sourcetype=msdhcp appears as src_mac in sourcetype=campusmgr.</P> Mon, 28 Sep 2020 13:31:30 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-Command/m-p/63062#M15566 KNichol5hd 2020-09-28T13:31:30Z https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-Command/m-p/63063#M15567 <P>Well you're tacking on a subsearch directly onto an <CODE>eval</CODE> statement. That's why you're getting an error.</P> Fri, 15 Mar 2013 14:20:51 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-Command/m-p/63063#M15567 Ayn 2013-03-15T14:20:51Z https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-Command/m-p/63064#M15568 <P>This the first I've ever worked with subsearches. Do you know what the correct format should be?</P> Fri, 15 Mar 2013 14:22:40 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-Command/m-p/63064#M15568 KNichol5hd 2013-03-15T14:22:40Z https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-Command/m-p/63065#M15569 <P>Depends. What's the purpose of the subsearch?</P> Fri, 15 Mar 2013 14:24:01 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-Command/m-p/63065#M15569 Ayn 2013-03-15T14:24:01Z https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-Command/m-p/63066#M15570 <P>I am trying to combine 3 separate searches into one.</P> <P>The first search begins within sourcetype=pan:traffic. I use the src_translated_port and src_translated_ip to return the src_ip that I am looking for.</P> <P>I then want to match that src_ip to the dest_ip within sourcetype=msdhcp, which is currently my second search. I use this search to return the dest_mac that I am looking for.</P> <P>The third search is within sourcetype=campusmgr. I want to match the dest_mac returned from sourcetype=msdhcp to the src_mac with sourcetype=campusmgr.</P> Mon, 28 Sep 2020 13:31:32 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-Command/m-p/63066#M15570 KNichol5hd 2020-09-28T13:31:32Z