Splunk Search

Adding a date to a string Message

griffinpair
Path Finder

I am trying to create an error message based on a time frame, the last 15 min. and now. So the error message would say,

"Client Missed file between 15:15:00 - 15:30:00"

The times are calculated at the time of the search and the following search below fails as "Error in 'eval' command: Typechecking failed. '+' only takes two strings or two numbers."

| eval 15MinEarly=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S")
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " + 15MinEarly + " - " Now

How do you convert the two times to string so I can concatenate them into the error message?

0 Karma
1 Solution

renjith_nair
Legend

@griffinpair,

Is it ok for you to change the variable name from 15MinEarly to MinEarly_15? Also change your search to add + to the last "Now"

| eval MinEarly_15=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") 
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " + MinEarly_15 + " - " + Now

Looks like splunk is bit confused to see the variables starting with digits 🙂

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@griffinpair,

Is it ok for you to change the variable name from 15MinEarly to MinEarly_15? Also change your search to add + to the last "Now"

| eval MinEarly_15=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") 
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " + MinEarly_15 + " - " + Now

Looks like splunk is bit confused to see the variables starting with digits 🙂

---
What goes around comes around. If it helps, hit it with Karma 🙂

griffinpair
Path Finder

That was exactly the problem. Thanks so much!

0 Karma

pradeepkumarg
Influencer

Use . for concatenation of strings

| eval 15MinEarly=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") 
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " .15MinEarly ." - ".Now
0 Karma

griffinpair
Path Finder

I got the following error:

⚠ Error in 'eval' command: The expression is malformed.

0 Karma

pradeepkumarg
Influencer

are your fields 15MinEarly and Now working? try

| table 15MinEarly Now

0 Karma

griffinpair
Path Finder

Yes. Both fields return expected values.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...