Splunk Search

Can anyone tell me why Splunk is throwing this error when using the foreach command?

nkankur
Path Finder
| foreach V* [eval PAC<<MATCHSTR>>=<<FIELD>>-Voice], 
| foreach PAC* [eval <<FIELD>>=if(<<FIELD>> < 0, -<<FIELD>>, 0)]

error -> Error in 'foreach' command: Only the last argument should be a search pipeline

0 Karma

koshyk
Super Champion

I can find 3 issues in above query.

  1. there is a comma , in your first line end. That's is wrong
  2. the string -voice should be concatenated to field using . " (dot and double quotes) to make it a string.
  3. the PAC value is doing if based on a numeric value, but you have concatenated with a string. This might give unexpected results

Please find corrected query

|makeresults | eval total=0| eval VariableA="100"| eval VariableB="200"
| foreach V* [eval PAC_<<MATCHSTR>>=<<FIELD>> . "-voice" ]  
| foreach PAC* [eval <<FIELD>>=if(<<FIELD>> < 0, -<<FIELD>>, 0)]
0 Karma

horsefez
Motivator

Hi nkankur,
I see an odd "," at the end of the first foreach statement... sure this needs to be there?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...