Splunk Search

How to return a single value from a subsearch into eval Part 2

hollybross1219
Path Finder

I found a different answer article with an example of what I'm trying to do, but I can't get it to work on my end.

I'd like to calculate a value using eval and subsearch (adding a column with all row values having this single calculated value). I've replicated what the past article advised, but I'm getting a "Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])." message. I've also identified that it's the eval with the subsearch causing this, because the query works when removing that function.

Past article with same question: https://answers.splunk.com/answers/240798/how-to-return-a-single-value-from-a-subsearch-into.html

Here's my query

splunk_server=indexer* index=wsi_tax_summary sourcetype=stash intuit_tid=* intuit_offeringid=* provider_id=* partnerId=* 
capability=* error_msg_service=* http_status_code_host=* ofx_schema_response_error!=null
| eval ofx_schema_response_error= [eval statements unimportant for this example]
| stats dc(intuit_tid)  as schema_error dc(eval(if(error_msg_service="OK", intuit_tid, null()))) as successful_imports by 
    ofx_schema_response_error
| eval total_events =
    [search splunk_server=indexer* index=wsi_tax_summary sourcetype=stash intuit_tid=* intuit_offeringid=* provider_id=* 
    partnerId=* capability=* error_msg_service=* http_status_code_host=*
    | stats dc(intuit_tid) as total_events
    | return total_events]
| eval failed_imports = schema_error - successful_imports
| sort - schema_error

Thanks!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

By default, returns returns a field name, not a value. To get the value, use | return $total_events.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

By default, returns returns a field name, not a value. To get the value, use | return $total_events.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...