Splunk Search

Error in 'eval' command: The 'first' function is unsupported or undefined.

Path Finder

I have written the below search string:

index=os source=interfaces
| multikv fields RXbytes, TXbytes
| eval firstRXBytes=first(RXbytes)
| eval lastRXBytes=last(RXbytes)
| eval Received_Bytes=round((last(RXbytes)-first(RXbytes))/300), 2)
| stats values(Received_Bytes) as RXBytes/sec by host

But is it providing me an error "Error in 'eval' command: The 'first' function is unsupported or undefined."


Tags (1)
0 Karma

Esteemed Legend

Also be aware that "first" does not mean "oldest" or "earliest", it means "first encountered while working backwards through the events" which means it is the same as "newest" or "latest". This is VERY confusing and I think Splunk should either oldest/newest or earliest/latest to the functions so that people who care about clarity (most of us) can abandon the use of first/last and use something less likely to cause confusion.

Ultra Champion


Use eval's mvindex function for that.

Path Finder

I need to know how can I retrieve the elements present in a list...

0 Karma

Path Finder

Thank you Kristian!!

I got it... but what I need is "RXbytes" data is getting generated in every 60 secs. I need to store the data for an interval of 5 mins that is 1 generated in one minute...then I need use that data...Is there any array kind of concept in SPlunk?

0 Karma