Splunk Search

How to return a single value from a subsearch into eval Part 2

hollybross1219
Path Finder

I found a different answer article with an example of what I'm trying to do, but I can't get it to work on my end.

I'd like to calculate a value using eval and subsearch (adding a column with all row values having this single calculated value). I've replicated what the past article advised, but I'm getting a "Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])." message. I've also identified that it's the eval with the subsearch causing this, because the query works when removing that function.

Past article with same question: https://answers.splunk.com/answers/240798/how-to-return-a-single-value-from-a-subsearch-into.html

Here's my query

splunk_server=indexer* index=wsi_tax_summary sourcetype=stash intuit_tid=* intuit_offeringid=* provider_id=* partnerId=* 
capability=* error_msg_service=* http_status_code_host=* ofx_schema_response_error!=null
| eval ofx_schema_response_error= [eval statements unimportant for this example]
| stats dc(intuit_tid)  as schema_error dc(eval(if(error_msg_service="OK", intuit_tid, null()))) as successful_imports by 
    ofx_schema_response_error
| eval total_events =
    [search splunk_server=indexer* index=wsi_tax_summary sourcetype=stash intuit_tid=* intuit_offeringid=* provider_id=* 
    partnerId=* capability=* error_msg_service=* http_status_code_host=*
    | stats dc(intuit_tid) as total_events
    | return total_events]
| eval failed_imports = schema_error - successful_imports
| sort - schema_error

Thanks!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

By default, returns returns a field name, not a value. To get the value, use | return $total_events.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

By default, returns returns a field name, not a value. To get the value, use | return $total_events.

---
If this reply helps you, an upvote would be appreciated.
Get Updates on the Splunk Community!

Is there an add-on for the Cisco Meraki devices?

We have many Cisco Meraki devices sending data via syslog to Splunk. Is there an add-on for ...

How to create a WIDS/IDPS/Internet Content Filtering dashboard in Splunk?

I need help on how to create a WIDS/IDPS/Internet Content Filtering dashboard in Splunk so that I can ...

Events has wrong timestamp, How to correct time config?

Hello Splunkers, I've an issue with my event time configuration. It has incorrect timestamp. Below are my ...