Archive
Highlighted

Subsearch in eval not working

Communicator

I'm trying to get the eval value in subsearch and use it for further searching in the query. I guess there is issue with case condition. Case statement works fine outside subsearch. This query is not working. It shows this error - Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).

index=test_idx|spath|dedup Project_ID|search Op_Completed_status="Completed" |table Op_completion_date Contract_ID Project_ID|eval cdate = strptime(Opera_completion_date ,"%m/%d/%Y %H:%M")|eval cdate_yr = strftime(cdate ,"%Y")|eval cdate_mon = strftime(cdate ,"%m")| eval cyr=[search index=test_idx|spath|dedup Project_ID|search Opera_Completed_status="Completed" |table Opera_completion_date Contract_ID Project_ID|eval cdate = strptime(Opera_completion_date ,"%m/%d/%Y %H:%M")|eval cdate_yr = strftime(cdate ,"%Y")|eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018")|table yr]|table cyr

Can some one please assist?

`

Tags (1)
0 Karma
Highlighted

Re: Subsearch in eval not working

Communicator

Hi k_harini,

Can you share sample data.

0 Karma
Highlighted

Re: Subsearch in eval not working

Champion

Can you explain what your trying to do here:
|eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018")

0 Karma
Highlighted

Re: Subsearch in eval not working

Communicator

FY18, FY17 are the tokens that are passed from another search. Would like to compare that and get corresponding year values - 2017 and 2018

0 Karma
Highlighted

Re: Subsearch in eval not working

Super Champion

why are you evaluating cdate and cdateyr in the subsearch? are those the tokens? you could roll them up into one eval statement `| eval cdateyr = strftime(strptime(Operacompletiondate ,"%m/%d/%Y %H:%M") ,"%Y")`

in your case statement, try adding adding ,1=1,"2018"):
| eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018",1=1,"2018")
or changing it to an if statement:
| eval yr = if("FY18"="FY17","2017","2018")

0 Karma