https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-first-function-is-unsupported-or/m-p/83961#M21393 <P>Thank you Kristian!!</P> <P>I got it... but what I need is "RXbytes" data is getting generated in every 60 secs. I need to store the data for an interval of 5 mins that is 1 generated in one minute...then I need use that data...Is there any array kind of concept in SPlunk?</P> Thu, 10 Jan 2013 18:06:54 GMT Splunk_U 2013-01-10T18:06:54Z https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-first-function-is-unsupported-or/m-p/83959#M21391 <P>I have written the below search string:</P> <P>index=os source=interfaces<BR /> | multikv fields RXbytes, TXbytes<BR /> | eval firstRXBytes=first(RXbytes)<BR /> | eval lastRXBytes=last(RXbytes)<BR /> | eval Received_Bytes=round((last(RXbytes)-first(RXbytes))/300), 2)<BR /> | stats values(Received_Bytes) as RXBytes/sec by host</P> <P>But is it providing me an error "Error in 'eval' command: The 'first' function is unsupported or undefined."</P> <P>Help!!!</P> Mon, 28 Sep 2020 13:04:56 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-first-function-is-unsupported-or/m-p/83959#M21391 Splunk_U 2020-09-28T13:04:56Z https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-first-function-is-unsupported-or/m-p/83960#M21392 <P><CODE>first()</CODE> is not a function to <CODE>eval</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/CommonEvalFunctions</A></P> <P>it is, however, to <CODE>stats</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions</A></P> <P>/Kristian</P> Thu, 10 Jan 2013 16:34:44 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-first-function-is-unsupported-or/m-p/83960#M21392 kristian_kolb 2013-01-10T16:34:44Z https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-first-function-is-unsupported-or/m-p/83961#M21393 <P>Thank you Kristian!!</P> <P>I got it... but what I need is "RXbytes" data is getting generated in every 60 secs. I need to store the data for an interval of 5 mins that is 1 generated in one minute...then I need use that data...Is there any array kind of concept in SPlunk?</P> Thu, 10 Jan 2013 18:06:54 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-first-function-is-unsupported-or/m-p/83961#M21393 Splunk_U 2013-01-10T18:06:54Z https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-first-function-is-unsupported-or/m-p/83962#M21394 <P>I need to know how can I retrieve the elements present in a list...</P> Thu, 10 Jan 2013 18:28:33 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-first-function-is-unsupported-or/m-p/83962#M21394 Splunk_U 2013-01-10T18:28:33Z https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-first-function-is-unsupported-or/m-p/83963#M21395 <P>Use <CODE>eval</CODE>'s <CODE>mvindex</CODE> function for that.</P> Thu, 10 Jan 2013 19:05:24 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-first-function-is-unsupported-or/m-p/83963#M21395 Ayn 2013-01-10T19:05:24Z https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-first-function-is-unsupported-or/m-p/83964#M21396 <P>Also be aware that "first" does not mean "oldest" or "earliest", it means "first encountered while working backwards through the events" which means it is the same as "newest" or "latest". This is VERY confusing and I think Splunk should either oldest/newest or earliest/latest to the functions so that people who care about clarity (most of us) can abandon the use of first/last and use something less likely to cause confusion.</P> Tue, 30 Dec 2014 15:02:41 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-first-function-is-unsupported-or/m-p/83964#M21396 woodcock 2014-12-30T15:02:41Z