Splunk Search
Highlighted

Error in Eval Command

Explorer

sourcetype=campusmgr earliest=-72h latest=+72h [search sourcetype=msdhcp earliest=03/10/2013:12:40:00 latest=03/10/2013:15:40:00 | eval destip=if (match(sourcetype,"pan:traffic"),srcip,"") [search sourcetype=pan:traffic srctranslatedport=##### srctranslatedip=###.###.##.## earliest=03/10/2013:12:40:00 latest=03/10/2013:15:40:00 | return 10 srcip] | return 10 destip] | chart count by user | sort - count

Error in 'eval' command: The operator at '(srcip="###.###.##.##") OR (srcip="###.###.##.##") OR (srcip="###.###.##.##") OR (srcip="###.###.##.##")' is invalid.

Can anyone tell me what I'm doing wrong here?

*The sourcetype=srcip in pan:traffic appears as destip in sourcetype=msdhcp.
*The destmac in sourcetype=msdhcp appears as srcmac in sourcetype=campusmgr.

Highlighted

Re: Error in Eval Command

Legend

Well you're tacking on a subsearch directly onto an eval statement. That's why you're getting an error.

0 Karma
Highlighted

Re: Error in Eval Command

Explorer

This the first I've ever worked with subsearches. Do you know what the correct format should be?

0 Karma
Highlighted

Re: Error in Eval Command

Legend

Depends. What's the purpose of the subsearch?

0 Karma
Highlighted

Re: Error in Eval Command

Explorer

I am trying to combine 3 separate searches into one.

The first search begins within sourcetype=pan:traffic. I use the srctranslatedport and srctranslatedip to return the src_ip that I am looking for.

I then want to match that srcip to the destip within sourcetype=msdhcp, which is currently my second search. I use this search to return the dest_mac that I am looking for.

The third search is within sourcetype=campusmgr. I want to match the destmac returned from sourcetype=msdhcp to the srcmac with sourcetype=campusmgr.

0 Karma