Actually the problem is in my main query,
sometimes the subsearch return events, sometimes not.
What i want to achieve is depending if i find result or not, it gives me different date.
Here the change i did in the subsearch ( it's what i want to achieve since the begining).
search index=gamification AND sourcetype= stash
| eval origin=originUpdate
| where origin="sparxea"
| eval time = _indextime
| eval updated=if(isnull(time),now(),_indextime)
| return $updated
Even if i should always return a date because of this line | eval updated=if(isnull(time),now(),_indextime)
eval function give me error eval dest_key = expression because when no events are found, eval is unable to generate values to return. I can't figure how to do it.
... View more