topic Re: iam receiving a message unbalanced quotes , i tried using back slash in Splunk Search

iam receiving a message unbalanced quotes , i tried using back slash

pavanraghav — Wed, 27 Nov 2019 08:32:56 GMT

 | eval e="$time_token.earliest$", l=$time_token.latest$"| eval e=case(match(e,"^\d+$"),e,e="" OR e="now" , "0" , true(), relative_time(now(),e)) | eval l=case(match(l,"^\d+$"),l,l="" OR l="now" , "2145916800", true(), relative_time(now(),l))

Re: iam receiving a message unbalanced quotes , i tried using back slash

renjith_nair — Wed, 27 Nov 2019 11:41:21 GMT

@pavanraghav ,

In your search above, you are missing a " in I=$time_token.latest$"

Also , please use the Code Sample to add your search snippets. I edited it for now

Re: iam receiving a message unbalanced quotes , i tried using back slash

arjunpkishore5 — Wed, 27 Nov 2019 13:17:42 GMT

your missing a quote in your eval

| eval e="$time_token.earliest$", l="$time_token.latest$"
| eval e=case(match(e,"^\d+$"),e,e="" or e="now" , "0" , true(), relative_time(now(),e)) 
| eval l=case(match(l,"^\d+$"),l,l="" or l="now" , "2145916800", true(), relative_time(now(),l))

Re: iam receiving a message unbalanced quotes , i tried using back slash

pavanraghav — Wed, 27 Nov 2019 14:00:47 GMT

thanks renjith

Re: iam receiving a message unbalanced quotes , i tried using back slash

pavanraghav — Wed, 27 Nov 2019 14:01:00 GMT

thanks arjun