https://community.splunk.com/t5/Splunk-Search/Error-in-UnifiedSearch-Unable-to-parse-the-Missing-LHS-for-AND/m-p/76092#M19238 <P>Because the implicit <CODE>format</CODE> of the subsearch inserts the <CODE>AND</CODE> keyword, making the result of your subsearch <CODE>((starttimeu="1234567590" AND endtimeu="1234567890"))</CODE>. Splunk syntax doesn't like the <CODE>AND</CODE> with time quantifiers. I personally consider this a bug.</P> <P>Also, <CODE>starttimeu</CODE> and <CODE>endtimeu</CODE> have been deprecated for some time now. Please use <CODE>earliest</CODE> and <CODE>latest</CODE> instead.</P> <P>The fix/workaround is to use and explicit <CODE>format</CODE> that doesn't insert the <CODE>AND</CODE> (which isn't necessary anyway):</P> <PRE><CODE>* [ search sourcetype=fireeye OR sourcetype=imap | eval earliest=_time | eval latest=_time+300 | fields earliest latest | format "(" "(" " " ")" "OR" ")" ] </CODE></PRE> Sun, 24 Oct 2010 08:29:34 GMT gkanapathy 2010-10-24T08:29:34Z https://community.splunk.com/t5/Splunk-Search/Error-in-UnifiedSearch-Unable-to-parse-the-Missing-LHS-for-AND/m-p/76091#M19237 <P>Does anyone know why I am getting the following error when running the following search to find surrounding events:</P> <P><CODE>* [ search sourcetype=fireeye OR sourcetype=imap | eval starttimeu=_time | eval endtimeu=_time+300 | fields + starttimeu endtimeu ]</CODE></P> <P>(Seen on Splunk search head version 4.1.5)</P> Sat, 23 Oct 2010 02:44:52 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-UnifiedSearch-Unable-to-parse-the-Missing-LHS-for-AND/m-p/76091#M19237 the_wolverine 2010-10-23T02:44:52Z https://community.splunk.com/t5/Splunk-Search/Error-in-UnifiedSearch-Unable-to-parse-the-Missing-LHS-for-AND/m-p/76092#M19238 <P>Because the implicit <CODE>format</CODE> of the subsearch inserts the <CODE>AND</CODE> keyword, making the result of your subsearch <CODE>((starttimeu="1234567590" AND endtimeu="1234567890"))</CODE>. Splunk syntax doesn't like the <CODE>AND</CODE> with time quantifiers. I personally consider this a bug.</P> <P>Also, <CODE>starttimeu</CODE> and <CODE>endtimeu</CODE> have been deprecated for some time now. Please use <CODE>earliest</CODE> and <CODE>latest</CODE> instead.</P> <P>The fix/workaround is to use and explicit <CODE>format</CODE> that doesn't insert the <CODE>AND</CODE> (which isn't necessary anyway):</P> <PRE><CODE>* [ search sourcetype=fireeye OR sourcetype=imap | eval earliest=_time | eval latest=_time+300 | fields earliest latest | format "(" "(" " " ")" "OR" ")" ] </CODE></PRE> Sun, 24 Oct 2010 08:29:34 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-UnifiedSearch-Unable-to-parse-the-Missing-LHS-for-AND/m-p/76092#M19238 gkanapathy 2010-10-24T08:29:34Z https://community.splunk.com/t5/Splunk-Search/Error-in-UnifiedSearch-Unable-to-parse-the-Missing-LHS-for-AND/m-p/76093#M19239 <P>Another workaround for this is to perform two sub-searches in succession, one of the earliest and one for the latest time values, like this:</P> <UL> <LI> [search sourcetype=syslog error |eval endtimeu = _time+300 | fields + endtimeu] [search sourcetype=syslog error |eval starttimeu = _time-300 | fields + starttimeu]</LI> </UL> Mon, 27 Jun 2011 18:16:21 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-UnifiedSearch-Unable-to-parse-the-Missing-LHS-for-AND/m-p/76093#M19239 maverick 2011-06-27T18:16:21Z