Streamed search execute failed because: Invalid number

[ebailey]

I am working on a new report and I am getting an error message I do not understand. Any help understanding the error message is much appreciated.

I want to diff the event time stamp which I have extracted out to a field named eventTime from a field called submissionReceived.

query

eventtype=test | rex "(?i)(?P\d+-\d+-\d+\s+\d+:\d+:\d+.\d+)\s+\w+(?:=[^=]*){10}" | eval et = strptime(eventTime, "%Y-%m-%d %H:%M:%S.%4N") | eval sr = strptime(submissionReceived, "%Y-%m-%d %H:%M:%S.%4N") | eval diff = tostring((et - sr), "duration") | timechart max(diff) by gID usenull=f useother=f

I am getting this back from the indexer

Streamed search execute failed because: Invalid number

event example

2015-01-29 07:03:19.9660 server=test instance=Main gID=1059 event=SubmStart submissionID=4cfa5b2d-f85d-4262-ba86-51f6783e4efc cID=100403 uID=2003484 tradingPartnerID=4000101 submissionReceived="2015-01-29 07:03:19.9348" pID=10056

I have no clue why I am getting this message. I don't see any errors in the splunkd.log. I looked at the job inspector, but nothing stood out. I can run a query just with the eventtype and the rex and I do not get the error so the issue is beyond the rex entry.

Thanks!

[richgalloway]

Try removing tostring(). Then timechart max(diff) will have a number to work with.

[ebailey]

I took your suggestion and wrote the eval a different way.

eventtype=test | rex "(?i)(?Pd+-d+-d+s+d+:d+:d+.d+)s+w+(?:=[^=]*){10}" | eval diff = strptime(eventTime, "%Y-%m-%d %H:%M:%S.%4N") - strptime(submissionReceived, "%Y-%m-%d %H:%M:%S.%4N") | timechart max(diff) by gID usenull=f useother=f

This seems to works. I guess I was giving the timechart invalid data.

Thanks

Ed