Splunk Search

How to return a single value from a subsearch into eval Part 2

hollybross1219
Path Finder

I found a different answer article with an example of what I'm trying to do, but I can't get it to work on my end.

I'd like to calculate a value using eval and subsearch (adding a column with all row values having this single calculated value). I've replicated what the past article advised, but I'm getting a "Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])." message. I've also identified that it's the eval with the subsearch causing this, because the query works when removing that function.

Past article with same question: https://answers.splunk.com/answers/240798/how-to-return-a-single-value-from-a-subsearch-into.html

Here's my query

splunk_server=indexer* index=wsi_tax_summary sourcetype=stash intuit_tid=* intuit_offeringid=* provider_id=* partnerId=* 
capability=* error_msg_service=* http_status_code_host=* ofx_schema_response_error!=null
| eval ofx_schema_response_error= [eval statements unimportant for this example]
| stats dc(intuit_tid)  as schema_error dc(eval(if(error_msg_service="OK", intuit_tid, null()))) as successful_imports by 
    ofx_schema_response_error
| eval total_events =
    [search splunk_server=indexer* index=wsi_tax_summary sourcetype=stash intuit_tid=* intuit_offeringid=* provider_id=* 
    partnerId=* capability=* error_msg_service=* http_status_code_host=*
    | stats dc(intuit_tid) as total_events
    | return total_events]
| eval failed_imports = schema_error - successful_imports
| sort - schema_error

Thanks!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

By default, returns returns a field name, not a value. To get the value, use | return $total_events.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

By default, returns returns a field name, not a value. To get the value, use | return $total_events.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...