Splunk Search

Error in Eval in Search Command. Please help.

ReachDataScient
Explorer

| makeresults
| eval ipaddress=192.168.1.1
| lookup AM ipaddress OUTPUT hostname
| table ipaddress,hostname
This works fine if I place the ipaddess between the double quotes other wise it throws Error in 'eval' command. The number 192.168.1.1 is invalid.

Any clue.

Tags (1)
0 Karma
1 Solution

tiagofbmm
Influencer

When you are putting an ip address, the "." is concatenating strings that are actually numbers, hence the error like "type mismatch"

View solution in original post

0 Karma

prabhu77749
Explorer

Wierd it works with out quotes for you .. but we should keep the value in double quotes to work..

| eval client_ip=192.162.207.160 - The number 192.162.207.160 is invalid.
| eval client_ip="192.162.207.160" - works fine

0 Karma

tiagofbmm
Influencer

When you are putting an ip address, the "." is concatenating strings that are actually numbers, hence the error like "type mismatch"

0 Karma

somesoni2
Revered Legend

IP address is a string, so it should be enclosed in double quotes. That's the syntax.

0 Karma

ReachDataScient
Explorer

On a dashboard I have an input text field where user can type the IP Address and I pass this as a token to the panel search shown above. The user would never type IP Address in double quotes, so they see the Error in 'eval' command. The number 192.168.1.1 is invalid display in the panel.

0 Karma

somesoni2
Revered Legend

You can either update your query to use the token within quotes OR update your text box to include double quotes as prefix/suffix for that. With that, you'd need to include a label/.note in your dashboard to instruct use to NOT enter with double quotes.

0 Karma

tiagofbmm
Influencer

Or just check whether your user input IP contains the \" or not and proceed accordingly by removing them or not

0 Karma

tiagofbmm
Influencer

Just use "$ip_token$" and carry on. It's up to you to take care of that if the user won't type the IP between quotes

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...