Archive

Error in Eval in Search Command. Please help.

| makeresults
| eval ipaddress=192.168.1.1
| lookup AM ipaddress OUTPUT hostname
| table ipaddress,hostname
This works fine if I place the ipaddess between the double quotes other wise it throws Error in 'eval' command. The number 192.168.1.1 is invalid.

Any clue.

Tags (1)
0 Karma
1 Solution

Influencer

When you are putting an ip address, the "." is concatenating strings that are actually numbers, hence the error like "type mismatch"

View solution in original post

0 Karma

Explorer

Wierd it works with out quotes for you .. but we should keep the value in double quotes to work..

| eval client_ip=192.162.207.160 - The number 192.162.207.160 is invalid.
| eval client_ip="192.162.207.160" - works fine

0 Karma

Influencer

When you are putting an ip address, the "." is concatenating strings that are actually numbers, hence the error like "type mismatch"

View solution in original post

0 Karma

Revered Legend

IP address is a string, so it should be enclosed in double quotes. That's the syntax.

0 Karma

On a dashboard I have an input text field where user can type the IP Address and I pass this as a token to the panel search shown above. The user would never type IP Address in double quotes, so they see the Error in 'eval' command. The number 192.168.1.1 is invalid display in the panel.

0 Karma

Revered Legend

You can either update your query to use the token within quotes OR update your text box to include double quotes as prefix/suffix for that. With that, you'd need to include a label/.note in your dashboard to instruct use to NOT enter with double quotes.

0 Karma

Influencer

Or just check whether your user input IP contains the \" or not and proceed accordingly by removing them or not

0 Karma

Influencer

Just use "$ip_token$" and carry on. It's up to you to take care of that if the user won't type the IP between quotes

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!