subsearch not returning IP address

[Shivs2k]

I am trying to get a subsearch to return a single value which represents an IP address and I am getting an error "Error in 'eval' command: the number (ip address) is invalid"

eval a=
[ search index=pan sourcetype=pan:traffic dest_port=22
| stats count as c by src_ip
| sort - c
| head 1|return $src_ip]

any ideas?

[ITWhisperer · Accepted solution]

Add format clause

eval a=
[ search index=pan sourcetype=pan:traffic dest_port=22
| stats count as c by src_ip
| sort - c
| head 1|return $src_ip|format]

[Shivs2k]

thanks, this is cleaner than my solution!

[Shivs2k]

ok I fixed it myself, you have to add quotes to it.

eval a=
[ search index=pan sourcetype=pan:traffic dest_port=22
| stats count as c by src_ip
| sort - c
| head 1|eval a="\""+src_ip+"\""|return $a]