Splunk Search

Adding a date to a string Message

griffinpair
Path Finder

I am trying to create an error message based on a time frame, the last 15 min. and now. So the error message would say,

"Client Missed file between 15:15:00 - 15:30:00"

The times are calculated at the time of the search and the following search below fails as "Error in 'eval' command: Typechecking failed. '+' only takes two strings or two numbers."

| eval 15MinEarly=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S")
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " + 15MinEarly + " - " Now

How do you convert the two times to string so I can concatenate them into the error message?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@griffinpair,

Is it ok for you to change the variable name from 15MinEarly to MinEarly_15? Also change your search to add + to the last "Now"

| eval MinEarly_15=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") 
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " + MinEarly_15 + " - " + Now

Looks like splunk is bit confused to see the variables starting with digits 🙂

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@griffinpair,

Is it ok for you to change the variable name from 15MinEarly to MinEarly_15? Also change your search to add + to the last "Now"

| eval MinEarly_15=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") 
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " + MinEarly_15 + " - " + Now

Looks like splunk is bit confused to see the variables starting with digits 🙂

Happy Splunking!

griffinpair
Path Finder

That was exactly the problem. Thanks so much!

0 Karma

pradeepkumarg
Influencer

Use . for concatenation of strings

| eval 15MinEarly=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") 
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " .15MinEarly ." - ".Now
0 Karma

griffinpair
Path Finder

I got the following error:

⚠ Error in 'eval' command: The expression is malformed.

0 Karma

pradeepkumarg
Influencer

are your fields 15MinEarly and Now working? try

| table 15MinEarly Now

0 Karma

griffinpair
Path Finder

Yes. Both fields return expected values.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...