Splunk Search

Subsearch in eval not working

k_harini
Communicator

I'm trying to get the eval value in subsearch and use it for further searching in the query. I guess there is issue with case condition. Case statement works fine outside subsearch. This query is not working. It shows this error - Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).

index=test_idx|spath|dedup Project_ID|search Op_Completed_status="Completed" |table Op_completion_date Contract_ID Project_ID|eval cdate = strptime(Opera_completion_date ,"%m/%d/%Y %H:%M")|eval cdate_yr = strftime(cdate ,"%Y")|eval cdate_mon = strftime(cdate ,"%m")| eval cyr=[search index=test_idx|spath|dedup Project_ID|search Opera_Completed_status="Completed" |table Opera_completion_date Contract_ID Project_ID|eval cdate = strptime(Opera_completion_date ,"%m/%d/%Y %H:%M")|eval cdate_yr = strftime(cdate ,"%Y")|eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018")|table yr]|table cyr

Can some one please assist?

`

Tags (1)
0 Karma

cmerriman
Super Champion

why are you evaluating cdate and cdate_yr in the subsearch? are those the tokens? you could roll them up into one eval statement | eval cdate_yr = strftime(strptime(Opera_completion_date ,"%m/%d/%Y %H:%M") ,"%Y")

in your case statement, try adding adding ,1=1,"2018"):
| eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018",1=1,"2018")
or changing it to an if statement:
| eval yr = if("FY18"="FY17","2017","2018")

0 Karma

p_gurav
Champion

Can you explain what your trying to do here:
|eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018")

0 Karma

k_harini
Communicator

FY18, FY17 are the tokens that are passed from another search. Would like to compare that and get corresponding year values - 2017 and 2018

0 Karma

anjambha
Communicator

Hi k_harini,

Can you share sample data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...