Splunk Search

Subsearch in eval not working


I'm trying to get the eval value in subsearch and use it for further searching in the query. I guess there is issue with case condition. Case statement works fine outside subsearch. This query is not working. It shows this error - Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).

index=test_idx|spath|dedup Project_ID|search Op_Completed_status="Completed" |table Op_completion_date Contract_ID Project_ID|eval cdate = strptime(Opera_completion_date ,"%m/%d/%Y %H:%M")|eval cdate_yr = strftime(cdate ,"%Y")|eval cdate_mon = strftime(cdate ,"%m")| eval cyr=[search index=test_idx|spath|dedup Project_ID|search Opera_Completed_status="Completed" |table Opera_completion_date Contract_ID Project_ID|eval cdate = strptime(Opera_completion_date ,"%m/%d/%Y %H:%M")|eval cdate_yr = strftime(cdate ,"%Y")|eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018")|table yr]|table cyr

Can some one please assist?


Tags (1)
0 Karma

Super Champion

why are you evaluating cdate and cdate_yr in the subsearch? are those the tokens? you could roll them up into one eval statement | eval cdate_yr = strftime(strptime(Opera_completion_date ,"%m/%d/%Y %H:%M") ,"%Y")

in your case statement, try adding adding ,1=1,"2018"):
| eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018",1=1,"2018")
or changing it to an if statement:
| eval yr = if("FY18"="FY17","2017","2018")

0 Karma


Can you explain what your trying to do here:
|eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018")

0 Karma


FY18, FY17 are the tokens that are passed from another search. Would like to compare that and get corresponding year values - 2017 and 2018

0 Karma


Hi k_harini,

Can you share sample data.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

Events has wrong timestamp, How to correct time config?

Hello Splunkers,&nbsp;I've an issue with my event time configuration. It has incorrect timestamp. Below are my ...

What is the use drop_dm_object_name() clause in a query with tstats.?

I am trying to find out what purpose drop_dm_object_name() serves.