Splunk Search
Highlighted

Error in 'eval' command: The 'first' function is unsupported or undefined.

Path Finder

I have written the below search string:

index=os source=interfaces
| multikv fields RXbytes, TXbytes
| eval firstRXBytes=first(RXbytes)
| eval lastRXBytes=last(RXbytes)
| eval ReceivedBytes=round((last(RXbytes)-first(RXbytes))/300), 2)
| stats values(Received
Bytes) as RXBytes/sec by host

But is it providing me an error "Error in 'eval' command: The 'first' function is unsupported or undefined."

Help!!!

Tags (1)
0 Karma
Highlighted

Re: Error in 'eval' command: The 'first' function is unsupported or undefined.

Ultra Champion
Highlighted

Re: Error in 'eval' command: The 'first' function is unsupported or undefined.

Path Finder

Thank you Kristian!!

I got it... but what I need is "RXbytes" data is getting generated in every 60 secs. I need to store the data for an interval of 5 mins that is 1 generated in one minute...then I need use that data...Is there any array kind of concept in SPlunk?

0 Karma
Highlighted

Re: Error in 'eval' command: The 'first' function is unsupported or undefined.

Path Finder

I need to know how can I retrieve the elements present in a list...

0 Karma
Highlighted

Re: Error in 'eval' command: The 'first' function is unsupported or undefined.

Legend

Use eval's mvindex function for that.

Highlighted

Re: Error in 'eval' command: The 'first' function is unsupported or undefined.

Esteemed Legend

Also be aware that "first" does not mean "oldest" or "earliest", it means "first encountered while working backwards through the events" which means it is the same as "newest" or "latest". This is VERY confusing and I think Splunk should either oldest/newest or earliest/latest to the functions so that people who care about clarity (most of us) can abandon the use of first/last and use something less likely to cause confusion.