I'm trying to search by a specific date, so I wanted to return the date to an eval, but when I run it, I get the message: Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')'.
This is the search I'm running:
| eval thedate=[return index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | stats first(_time) as _time] | table thedate
-------------------------------------- EDIT: 8/27/15 9:49am --------------------------------------
So I realize now that I was using the return command incorrectly, here's what I'm getting now:
| eval thedate=[search index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | return _time] | table thedate
But I'm still getting the error: Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr])
The eval does accept subsearches, but you need return the value instead of the field using return $fieldname. See this runanywhere sample
| gentimes start=-1 | eval temp=[| gentimes start=-1 | eval endhuman="\"".endhuman."\""| return $endhuman]
Your query would look like this
| eval thedate=[search index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | return $_time] | table thedate
The eval does accept subsearches, but you need return the value instead of the field using return $fieldname. See this runanywhere sample
| gentimes start=-1 | eval temp=[| gentimes start=-1 | eval endhuman="\"".endhuman."\""| return $endhuman]
Your query would look like this
| eval thedate=[search index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | return $_time] | table thedate
Eval statements cannot contain subsearches. Try this instead:
index=[redacted] sourcetype=[redacted] "[redacted]=[redacted]" | dedup "DATE" | sort +_time | head 1 | bucket _time span=1d | stats first(_time) as thedate | table thedate
Ohh okay, I didn't know that. I think I need rethink this search query. Thanks.
you can't perform an operation "as _time"
you could do something like this:
stats first(_time) as Time . . .