Error in 'eval' command: The 'first' function is unsupported or undefined.

[Splunk_U]

I have written the below search string:

index=os source=interfaces
| multikv fields RXbytes, TXbytes
| eval firstRXBytes=first(RXbytes)
| eval lastRXBytes=last(RXbytes)
| eval Received_Bytes=round((last(RXbytes)-first(RXbytes))/300), 2)
| stats values(Received_Bytes) as RXBytes/sec by host

But is it providing me an error "Error in 'eval' command: The 'first' function is unsupported or undefined."

Help!!!

[woodcock]

Also be aware that "first" does not mean "oldest" or "earliest", it means "first encountered while working backwards through the events" which means it is the same as "newest" or "latest". This is VERY confusing and I think Splunk should either oldest/newest or earliest/latest to the functions so that people who care about clarity (most of us) can abandon the use of first/last and use something less likely to cause confusion.

[kristian_kolb]

first() is not a function to eval

http://docs.splunk.com/Documentation/Splunk/5.0.1/SearchReference/CommonEvalFunctions

it is, however, to stats

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonStatsFunctions

/Kristian

[Ayn]

Use eval's mvindex function for that.

[Splunk_U]

I need to know how can I retrieve the elements present in a list...

[Splunk_U]

Thank you Kristian!!

I got it... but what I need is "RXbytes" data is getting generated in every 60 secs. I need to store the data for an interval of 5 mins that is 1 generated in one minute...then I need use that data...Is there any array kind of concept in SPlunk?