topic Re: How to return a timestamp to an eval? in Splunk Search

How to return a timestamp to an eval?

sam_jacob — Thu, 27 Aug 2015 14:32:22 GMT

I'm trying to search by a specific date, so I wanted to return the date to an eval, but when I run it, I get the message: Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')'.

This is the search I'm running:

| eval thedate=[return index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | stats first(_time) as _time] | table thedate

-------------------------------------- EDIT: 8/27/15 9:49am --------------------------------------
So I realize now that I was using the return command incorrectly, here's what I'm getting now:

| eval thedate=[search index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | return _time] | table thedate

But I'm still getting the error: Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])

Re: How to return a timestamp to an eval?

tskinnerivsec — Thu, 27 Aug 2015 14:40:06 GMT

you can't perform an operation "as _time"

you could do something like this:

stats first(_time) as Time . . .

Re: How to return a timestamp to an eval?

richgalloway — Thu, 27 Aug 2015 14:46:58 GMT

Eval statements cannot contain subsearches. Try this instead:

index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | stats first(_time) as thedate | table thedate

Re: How to return a timestamp to an eval?

sam_jacob — Thu, 27 Aug 2015 14:53:06 GMT

Ohh okay, I didn't know that. I think I need rethink this search query. Thanks.

Re: How to return a timestamp to an eval?

somesoni2 — Thu, 27 Aug 2015 16:49:15 GMT

The eval does accept subsearches, but you need return the value instead of the field using return $fieldname. See this runanywhere sample

| gentimes start=-1 | eval temp=[| gentimes start=-1 | eval endhuman="\"".endhuman."\""| return $endhuman]

Your query would look like this

| eval thedate=[search index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | return $_time] | table thedate