https://community.splunk.com/t5/Splunk-Search/subsearch-error/m-p/88702#M22706 <P>I tried to use subsearch to find the <EM>2nd last</EM> synchronization event by using the following:</P> <P>synchronization [search synchronization | head 1 | eval earliest=relative_time(_time,"-1H") | eval latest=_time | fields earliest, latest]</P> <P>but I received the error message</P> <P>Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side.</P> <P>What is wrong here and what is the fix? Thanks.</P> Mon, 28 Sep 2020 09:58:04 GMT myli12 2020-09-28T09:58:04Z https://community.splunk.com/t5/Splunk-Search/subsearch-error/m-p/88702#M22706 <P>I tried to use subsearch to find the <EM>2nd last</EM> synchronization event by using the following:</P> <P>synchronization [search synchronization | head 1 | eval earliest=relative_time(_time,"-1H") | eval latest=_time | fields earliest, latest]</P> <P>but I received the error message</P> <P>Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side.</P> <P>What is wrong here and what is the fix? Thanks.</P> Mon, 28 Sep 2020 09:58:04 GMT https://community.splunk.com/t5/Splunk-Search/subsearch-error/m-p/88702#M22706 myli12 2020-09-28T09:58:04Z https://community.splunk.com/t5/Splunk-Search/subsearch-error/m-p/88703#M22707 <P>It would be a lot easier and fast to get the second last one with:</P> <PRE><CODE>synchronization | head 2 | tail 1 </CODE></PRE> <HR /> <P>But the explanation for your error is <A href="http://splunk-base.splunk.com/answers/8271/error-in-unifiedsearch-unable-to-parse-the-missing-lhs-for-and-search-error-when-searching-for-surrounding-events-why">http://splunk-base.splunk.com/answers/8271/error-in-unifiedsearch-unable-to-parse-the-missing-lhs-for-and-search-error-when-searching-for-surrounding-events-why</A></P> <P>so:</P> <PRE><CODE>synchronization [search synchronization | head 1 | eval earliest=relative_time(_time,"-1H") | eval latest=_time | fields earliest, latest | format "(" "(" " " ")" "OR" ")" ] </CODE></PRE> Sat, 08 Oct 2011 00:01:08 GMT https://community.splunk.com/t5/Splunk-Search/subsearch-error/m-p/88703#M22707 gkanapathy 2011-10-08T00:01:08Z