Splunk Search

How to return a timestamp to an eval?

sam_jacob
Path Finder

I'm trying to search by a specific date, so I wanted to return the date to an eval, but when I run it, I get the message: Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')'.

This is the search I'm running:

| eval thedate=[return index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | stats first(_time) as _time] | table thedate

-------------------------------------- EDIT: 8/27/15 9:49am --------------------------------------
So I realize now that I was using the return command incorrectly, here's what I'm getting now:

| eval thedate=[search index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | return _time] | table thedate

But I'm still getting the error: Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

The eval does accept subsearches, but you need return the value instead of the field using return $fieldname. See this runanywhere sample

| gentimes start=-1 | eval temp=[| gentimes start=-1 | eval endhuman="\"".endhuman."\""| return $endhuman]

Your query would look like this

| eval thedate=[search index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | return $_time] | table thedate

View solution in original post

somesoni2
Revered Legend

The eval does accept subsearches, but you need return the value instead of the field using return $fieldname. See this runanywhere sample

| gentimes start=-1 | eval temp=[| gentimes start=-1 | eval endhuman="\"".endhuman."\""| return $endhuman]

Your query would look like this

| eval thedate=[search index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | return $_time] | table thedate

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Eval statements cannot contain subsearches. Try this instead:

index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | stats first(_time) as thedate | table thedate
---
If this reply helps you, an upvote would be appreciated.

sam_jacob
Path Finder

Ohh okay, I didn't know that. I think I need rethink this search query. Thanks.

0 Karma

tskinnerivsec
Contributor

you can't perform an operation "as _time"

you could do something like this:

stats first(_time) as Time . . .

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!