Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Error in Eval in Search Command. Please help.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
| makeresults
| eval ipaddress=192.168.1.1
| lookup AM ipaddress OUTPUT hostname
| table ipaddress,hostname
This works fine if I place the ipaddess between the double quotes other wise it throws Error in 'eval' command. The number 192.168.1.1 is invalid.
Any clue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you are putting an ip address, the "." is concatenating strings that are actually numbers, hence the error like "type mismatch"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Wierd it works with out quotes for you .. but we should keep the value in double quotes to work..
| eval client_ip=192.162.207.160 - The number 192.162.207.160 is invalid.
| eval client_ip="192.162.207.160" - works fine
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you are putting an ip address, the "." is concatenating strings that are actually numbers, hence the error like "type mismatch"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
IP address is a string, so it should be enclosed in double quotes. That's the syntax.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
On a dashboard I have an input text field where user can type the IP Address and I pass this as a token to the panel search shown above. The user would never type IP Address in double quotes, so they see the Error in 'eval' command. The number 192.168.1.1 is invalid display in the panel.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can either update your query to use the token within quotes OR update your text box to include double quotes as prefix/suffix for that. With that, you'd need to include a label/.note in your dashboard to instruct use to NOT enter with double quotes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Or just check whether your user input IP contains the \" or not and proceed accordingly by removing them or not
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just use "$ip_token$" and carry on. It's up to you to take care of that if the user won't type the IP between quotes
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
