topic Re: Error in my search in Splunk Search

Why do I have an error in my search?

Italy1358 — Mon, 23 May 2022 16:10:06 GMT

It says that my eval is malformed, any suggestions?

Re: Error in my search

somesoni2 — Mon, 23 May 2022 13:15:50 GMT

Is this query run on a dashboard? What's your objective for the search?

I believe this line is the culprit

| eval relative_time = current_date "+3month"

What are you trying to do with this line? If you want to concatenate strings, use like this

| eval relative_time = tostring(current_date)."+3month"

If you want to add 3 months to current_date, try like this

| eval relative_time=relative_time(strptime(current_date,"%Y-%m-%dt%H:%M:%S"),"+3mon")

Re: Error in my search

Italy1358 — Mon, 23 May 2022 13:18:53 GMT

It is for a dashboard, when a user is entered, the month to revisit is selected so I need a way to check when the user is entered against the month selected to say whether the user is active or expired. That is what I am trying to do here. It is for an allow list that I am making using a dashboard.
@somesoni2

Re: Error in my search

Italy1358 — Mon, 23 May 2022 13:28:04 GMT

Re: Error in my search

somesoni2 — Mon, 23 May 2022 13:56:09 GMT

What all columns are there in the lookup US.csv? When user selects $3month$ values, what values it holds (a date or month)?

Re: Error in my search

Italy1358 — Mon, 23 May 2022 13:57:56 GMT

User, description, revisit, action

The revisit is a dropdown with choices of 1 month, 2 month, 3 month, 4 month, 5 month, and 6 month.
@somesoni2

Re: Error in my search

Italy1358 — Mon, 23 May 2022 13:58:43 GMT

These are the columns in the cvs:
current_date, user, category, department, description, revisit, duration
@somesoni2

Re: Error in my search

somesoni2 — Mon, 23 May 2022 15:27:30 GMT

So do you want to check if US.csv->revisit (assuming that column has date value) is within 3months of current_date?

Re: Error in my search

Italy1358 — Mon, 23 May 2022 15:59:02 GMT

Yeah
@somesoni2

Re: Error in my search

somesoni2 — Mon, 23 May 2022 17:44:56 GMT

Give this a try

If looking for revisit to be within past 3 months

| inputlookup US.csv | rename COMMENT as "Below converts revisit column to epoch" | eval current_date=strptime(revisit,"%Y-%m-%dt%H:%M:%S") | eval 3month=30*24*60*60 | rename COMMENT as "Below finds 3 months from today (past date)" | eval revisit_date=relative_time(now(),"-3mon") | rename COMMENT as "Below checks if current date(revisit) is within 3 months from today, set to expire" | eval duration = if(current_date <= revisit_date, "Expired", "Valid") | table current_date, user, category, department, description, revisit, duration

If looking for revisit to be within

| inputlookup US.csv | rename COMMENT as "Below converts revisit column to epoch" | eval current_date=strptime(revisit,"%Y-%m-%dt%H:%M:%S") | eval 3month=30*24*60*60 | rename COMMENT as "Below finds 3 months from today (past date)" | eval revisit_date=relative_time(now(),"+3mon") | rename COMMENT as "Below checks if current date(revisit) is within 3 months from today, set to expire" | eval duration = if(current_date >= revisit_date, "Expired", "Valid") | table current_date, user, category, department, description, revisit, duration

3 months in future

Re: Error in my search

Italy1358 — Mon, 23 May 2022 19:14:19 GMT

Here is a sample of my dashboard:

@somesoni2

So the user chooses the month for revisit then from todays entry date to the next 3 months or so I want to see if there valid still or not.