Can anyone tell me why Splunk is throwing this error when using the foreach command?

[nkankur]

| foreach V* [eval PAC<<MATCHSTR>>=<<FIELD>>-Voice], 
| foreach PAC* [eval <<FIELD>>=if(<<FIELD>> < 0, -<<FIELD>>, 0)]

error -> Error in 'foreach' command: Only the last argument should be a search pipeline

[koshyk]

I can find 3 issues in above query.

1. there is a comma , in your first line end. That's is wrong
2. the string -voice should be concatenated to field using . " (dot and double quotes) to make it a string.
3. the PAC value is doing if based on a numeric value, but you have concatenated with a string. This might give unexpected results

Please find corrected query

|makeresults | eval total=0| eval VariableA="100"| eval VariableB="200"
| foreach V* [eval PAC_<<MATCHSTR>>=<<FIELD>> . "-voice" ]  
| foreach PAC* [eval <<FIELD>>=if(<<FIELD>> < 0, -<<FIELD>>, 0)]

[horsefez]

Hi nkankur,
I see an odd "," at the end of the first foreach statement... sure this needs to be there?