Splunk Search

Error in 'eval' command: The 'first' function is unsupported or undefined.

Splunk_U
Path Finder

I have written the below search string:

index=os source=interfaces
| multikv fields RXbytes, TXbytes
| eval firstRXBytes=first(RXbytes)
| eval lastRXBytes=last(RXbytes)
| eval Received_Bytes=round((last(RXbytes)-first(RXbytes))/300), 2)
| stats values(Received_Bytes) as RXBytes/sec by host

But is it providing me an error "Error in 'eval' command: The 'first' function is unsupported or undefined."

Help!!!

Tags (1)
0 Karma

woodcock
Esteemed Legend

Also be aware that "first" does not mean "oldest" or "earliest", it means "first encountered while working backwards through the events" which means it is the same as "newest" or "latest". This is VERY confusing and I think Splunk should either oldest/newest or earliest/latest to the functions so that people who care about clarity (most of us) can abandon the use of first/last and use something less likely to cause confusion.

kristian_kolb
Ultra Champion

Ayn
Legend

Use eval's mvindex function for that.

Splunk_U
Path Finder

I need to know how can I retrieve the elements present in a list...

0 Karma

Splunk_U
Path Finder

Thank you Kristian!!

I got it... but what I need is "RXbytes" data is getting generated in every 60 secs. I need to store the data for an interval of 5 mins that is 1 generated in one minute...then I need use that data...Is there any array kind of concept in SPlunk?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...