How to return a single value from a subsearch into eval Part 2

[hollybross1219]

I found a different answer article with an example of what I'm trying to do, but I can't get it to work on my end.

I'd like to calculate a value using eval and subsearch (adding a column with all row values having this single calculated value). I've replicated what the past article advised, but I'm getting a "Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])." message. I've also identified that it's the eval with the subsearch causing this, because the query works when removing that function.

Past article with same question: https://answers.splunk.com/answers/240798/how-to-return-a-single-value-from-a-subsearch-into.html

Here's my query

splunk_server=indexer* index=wsi_tax_summary sourcetype=stash intuit_tid=* intuit_offeringid=* provider_id=* partnerId=* 
capability=* error_msg_service=* http_status_code_host=* ofx_schema_response_error!=null
| eval ofx_schema_response_error= [eval statements unimportant for this example]
| stats dc(intuit_tid)  as schema_error dc(eval(if(error_msg_service="OK", intuit_tid, null()))) as successful_imports by 
    ofx_schema_response_error
| eval total_events =
    [search splunk_server=indexer* index=wsi_tax_summary sourcetype=stash intuit_tid=* intuit_offeringid=* provider_id=* 
    partnerId=* capability=* error_msg_service=* http_status_code_host=*
    | stats dc(intuit_tid) as total_events
    | return total_events]
| eval failed_imports = schema_error - successful_imports
| sort - schema_error

Thanks!

[richgalloway · Accepted solution]

By default, returns returns a field name, not a value. To get the value, use | return $total_events.