How to return a timestamp to an eval?

[sam_jacob]

I'm trying to search by a specific date, so I wanted to return the date to an eval, but when I run it, I get the message: Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')'.

This is the search I'm running:

| eval thedate=[return index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | stats first(_time) as _time] | table thedate

-------------------------------------- EDIT: 8/27/15 9:49am --------------------------------------
So I realize now that I was using the return command incorrectly, here's what I'm getting now:

| eval thedate=[search index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | return _time] | table thedate

But I'm still getting the error: Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])

[somesoni2 · Accepted solution]

The eval does accept subsearches, but you need return the value instead of the field using return $fieldname. See this runanywhere sample

| gentimes start=-1 | eval temp=[| gentimes start=-1 | eval endhuman="\"".endhuman."\""| return $endhuman]

Your query would look like this

| eval thedate=[search index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | return $_time] | table thedate

[richgalloway]

Eval statements cannot contain subsearches. Try this instead:

index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | stats first(_time) as thedate | table thedate

[sam_jacob]

Ohh okay, I didn't know that. I think I need rethink this search query. Thanks.

[tskinnerivsec]

you can't perform an operation "as _time"

you could do something like this:

stats first(_time) as Time . . .