Splunk Search

Adding a date to a string Message

griffinpair
Path Finder

I am trying to create an error message based on a time frame, the last 15 min. and now. So the error message would say,

"Client Missed file between 15:15:00 - 15:30:00"

The times are calculated at the time of the search and the following search below fails as "Error in 'eval' command: Typechecking failed. '+' only takes two strings or two numbers."

| eval 15MinEarly=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S")
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " + 15MinEarly + " - " Now

How do you convert the two times to string so I can concatenate them into the error message?

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@griffinpair,

Is it ok for you to change the variable name from 15MinEarly to MinEarly_15? Also change your search to add + to the last "Now"

| eval MinEarly_15=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") 
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " + MinEarly_15 + " - " + Now

Looks like splunk is bit confused to see the variables starting with digits 🙂

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@griffinpair,

Is it ok for you to change the variable name from 15MinEarly to MinEarly_15? Also change your search to add + to the last "Now"

| eval MinEarly_15=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") 
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " + MinEarly_15 + " - " + Now

Looks like splunk is bit confused to see the variables starting with digits 🙂

Happy Splunking!

griffinpair
Path Finder

That was exactly the problem. Thanks so much!

0 Karma

pradeepkumarg
Influencer

Use . for concatenation of strings

| eval 15MinEarly=strftime(relative_time(now(), "-15m"), "%m/%d/%Y %H:%M:%S") 
| eval Now=strftime(now(), "%m/%d/%Y %H:%M:%S")
| eval ErrorMessage = "Client Missed file between: " .15MinEarly ." - ".Now
0 Karma

griffinpair
Path Finder

I got the following error:

⚠ Error in 'eval' command: The expression is malformed.

0 Karma

pradeepkumarg
Influencer

are your fields 15MinEarly and Now working? try

| table 15MinEarly Now

0 Karma

griffinpair
Path Finder

Yes. Both fields return expected values.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...