Subsearch in eval not working

[k_harini]

I'm trying to get the eval value in subsearch and use it for further searching in the query. I guess there is issue with case condition. Case statement works fine outside subsearch. This query is not working. It shows this error - Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).

index=test_idx|spath|dedup Project_ID|search Op_Completed_status="Completed" |table Op_completion_date Contract_ID Project_ID|eval cdate = strptime(Opera_completion_date ,"%m/%d/%Y %H:%M")|eval cdate_yr = strftime(cdate ,"%Y")|eval cdate_mon = strftime(cdate ,"%m")| eval cyr=[search index=test_idx|spath|dedup Project_ID|search Opera_Completed_status="Completed" |table Opera_completion_date Contract_ID Project_ID|eval cdate = strptime(Opera_completion_date ,"%m/%d/%Y %H:%M")|eval cdate_yr = strftime(cdate ,"%Y")|eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018")|table yr]|table cyr


Can some one please assist?

`

[cmerriman]

why are you evaluating cdate and cdate_yr in the subsearch? are those the tokens? you could roll them up into one eval statement | eval cdate_yr = strftime(strptime(Opera_completion_date ,"%m/%d/%Y %H:%M") ,"%Y")

in your case statement, try adding adding ,1=1,"2018"):
| eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018",1=1,"2018")
or changing it to an if statement:
| eval yr = if("FY18"="FY17","2017","2018")

[p_gurav]

Can you explain what your trying to do here:
|eval yr = case("FY18"="FY17","2017","FY18"="FY18","2018")

[k_harini]

FY18, FY17 are the tokens that are passed from another search. Would like to compare that and get corresponding year values - 2017 and 2018

[anjambha]

Hi k_harini,

Can you share sample data.