subsearch error

[myli12]

I tried to use subsearch to find the 2nd last synchronization event by using the following:

synchronization [search synchronization | head 1 | eval earliest=relative_time(_time,"-1H") | eval latest=_time | fields earliest, latest]

but I received the error message

Error in 'search' command: Unable to parse the search: 'AND' operator is missing a clause on the left hand side.

What is wrong here and what is the fix? Thanks.

[gkanapathy]

It would be a lot easier and fast to get the second last one with:

synchronization | head 2 | tail 1

---

But the explanation for your error is http://splunk-base.splunk.com/answers/8271/error-in-unifiedsearch-unable-to-parse-the-missing-lhs-fo...

so:

synchronization [search synchronization | head 1 | eval earliest=relative_time(_time,"-1H") | eval latest=_time | fields earliest, latest | format "(" "(" " " ")" "OR" ")" ]