Reporting

Streamed search execute failed because: Invalid number

ebailey
Communicator

I am working on a new report and I am getting an error message I do not understand. Any help understanding the error message is much appreciated.

I want to diff the event time stamp which I have extracted out to a field named eventTime from a field called submissionReceived.

query

eventtype=test | rex "(?i)(?P\d+-\d+-\d+\s+\d+:\d+:\d+.\d+)\s+\w+(?:=[^=]*){10}" | eval et = strptime(eventTime, "%Y-%m-%d %H:%M:%S.%4N") | eval sr = strptime(submissionReceived, "%Y-%m-%d %H:%M:%S.%4N") | eval diff = tostring((et - sr), "duration") | timechart max(diff) by gID usenull=f useother=f

I am getting this back from the indexer

Streamed search execute failed because: Invalid number

event example

2015-01-29 07:03:19.9660 server=test instance=Main gID=1059 event=SubmStart submissionID=4cfa5b2d-f85d-4262-ba86-51f6783e4efc cID=100403 uID=2003484 tradingPartnerID=4000101 submissionReceived="2015-01-29 07:03:19.9348" pID=10056

I have no clue why I am getting this message. I don't see any errors in the splunkd.log. I looked at the job inspector, but nothing stood out. I can run a query just with the eventtype and the rex and I do not get the error so the issue is beyond the rex entry.

Thanks!

richgalloway
SplunkTrust
SplunkTrust

Try removing tostring(). Then timechart max(diff) will have a number to work with.

---
If this reply helps you, Karma would be appreciated.
0 Karma

ebailey
Communicator

I took your suggestion and wrote the eval a different way.

eventtype=test | rex "(?i)(?Pd+-d+-d+s+d+:d+:d+.d+)s+w+(?:=[^=]*){10}" | eval diff = strptime(eventTime, "%Y-%m-%d %H:%M:%S.%4N") - strptime(submissionReceived, "%Y-%m-%d %H:%M:%S.%4N") | timechart max(diff) by gID usenull=f useother=f

This seems to works. I guess I was giving the timechart invalid data.

Thanks

Ed

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...