Splunk Search

sub search and regular search does not return the same value

matansocher
Contributor

Hi

I get the weird result when trying to run the same search in a subsearch and in a regular search.
This is my search:

| inputcsv MilestonesMPS 
| search Design_Element_Name="QUP v3" TASK_SOC_NAME="Napali" Report_Milestone="*P1*" 
| return $TaskDeadline

When I run it as a regular search on its own it returns: "01-02-16", which is the right data.
When I run it as a sub search like that, the result in "p1Date" field is: "-17":

| inputcsv MilestonesMPS 
| search Design_Element_Name="QUP v3" TASK_SOC_NAME="Napali" Report_Milestone="*P*"

| eval p1Date = 
    [| inputcsv MilestonesMPS 
    | search Design_Element_Name="QUP v3" TASK_SOC_NAME="Napali" Report_Milestone="*P1*" 
    | return $TaskDeadline] 

| table Design_Element_Name TASK_SOC_NAME p1Date

What is happening here?

Thanks

0 Karma
1 Solution

HiroshiSatoh
Champion

Arithmetically calculated by EVAL is -17.
p1Date = 1 - 2 - 16 =-17
Is -17 useless?

Try this!
| eval p1Date =
[| inputcsv MilestonesMPS
| search Design_Element_Name="QUP v3" TASK_SOC_NAME="Napali" Report_Milestone="P1"
|head 1| table TaskDeadline |rename TaskDeadline as query]

View solution in original post

0 Karma

HiroshiSatoh
Champion

Arithmetically calculated by EVAL is -17.
p1Date = 1 - 2 - 16 =-17
Is -17 useless?

Try this!
| eval p1Date =
[| inputcsv MilestonesMPS
| search Design_Element_Name="QUP v3" TASK_SOC_NAME="Napali" Report_Milestone="P1"
|head 1| table TaskDeadline |rename TaskDeadline as query]

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...