Splunk Search

Adding a date to a string Message

griffinpair
Path Finder

I am trying to create an error message based on a time frame, the last 15 min. and now. So the error message would say,

"Client Missed file between 15:15:00 - 15:30:00"

The times are calculated at the time of the search and the following search below fails as "Error in 'eval' command: Typechecking failed. '+' only takes two strings or two numbers."

| eval 15MinEarly=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S")
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " + 15MinEarly + " - " Now

How do you convert the two times to string so I can concatenate them into the error message?

0 Karma
1 Solution

renjith_nair
Legend

@griffinpair,

Is it ok for you to change the variable name from 15MinEarly to MinEarly_15? Also change your search to add + to the last "Now"

| eval MinEarly_15=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") 
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " + MinEarly_15 + " - " + Now

Looks like splunk is bit confused to see the variables starting with digits 🙂

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@griffinpair,

Is it ok for you to change the variable name from 15MinEarly to MinEarly_15? Also change your search to add + to the last "Now"

| eval MinEarly_15=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") 
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " + MinEarly_15 + " - " + Now

Looks like splunk is bit confused to see the variables starting with digits 🙂

---
What goes around comes around. If it helps, hit it with Karma 🙂

griffinpair
Path Finder

That was exactly the problem. Thanks so much!

0 Karma

pradeepkumarg
Influencer

Use . for concatenation of strings

| eval 15MinEarly=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") 
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " .15MinEarly ." - ".Now
0 Karma

griffinpair
Path Finder

I got the following error:

⚠ Error in 'eval' command: The expression is malformed.

0 Karma

pradeepkumarg
Influencer

are your fields 15MinEarly and Now working? try

| table 15MinEarly Now

0 Karma

griffinpair
Path Finder

Yes. Both fields return expected values.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...