Help with passing search result to eval failing

[dhivyamu]

I'm trying you create a variable out of a search result using eval.

This works fine, I get a single row, and a column with error lines:

search index=sap_log_index message_type="E" | eventstats list(message_text) as errorLines | nomv errorLines | dedup errorLines | table errorLines

But the below search fails with malformed exception:

index="sap_idoc_index" | eval errorLines=[search index=sap_log_index message_type="E" | eventstats list(message_text) as errorLines | nomv errorLines | dedup errorLines | return $errorLines] | eval error_msg = if(Status=="41", errorLines, ""), status =  if(Status=="41", "Failed", "Success") | table idoc_number, status, error_msg

[harishalipaka]

@dhivyamu

index="_internal" |head 1| eval errorLines= 
     [ search index=_internal  
     | stats count(source) as errorLines 
     |return $errorLines] ,Status=41| eval error_msg = if(Status=="41", errorLines, ""), status = if(Status=="41", "Failed", "Success") 
 | table errorLines, status, error_msg,Status

[arjunpkishore5]

This is what you need

index="sap_idoc_index" 
| eval errorLines= 
    [ search index=sap_log_index message_type="E" 
    | stats values(message_text) as errorLines 
    |return $errorLines] 
| eval error_msg = if(Status=="41", errorLines, ""), status = if(Status=="41", "Failed", "Success") 
| table idoc_number, status, error_msg

[dhivyamu]

Thank you, this is so neat. But I still get the same error. The search works fine outside but doesn't fits in eval though it returns a single value 😞