I'm attempting to use a subsearch to extract a number of integers in order to transpose those integers as columns. Here is the code for the subsearch:
|eval thing=[| inputlookup lookup.csv
| stats values(tests) by tests
| sort 15 -tests
| stats values(tests) as str
| return $str]
The search run by itself returns something like "123 124 125 126 127...", so I'm confused why when I run it as a subsearch it returns:
"Error in 'eval' command: The expression is malformed."
I've tried following some similar examples I've seen here, but I can't seem to find anything that works for me.
Thanks.
The return command, by default, returns only the single value from first row of specified field (as string). The field 'str' in your subsearch is a multivalued field and thus causes issue in eval. Assuming you want to return list of all 15 'tests' values in a space-delimited string and save it to field 'thing', try something like this
...|eval thing=[| inputlookup lookup.csv | stats values(tests) by tests | sort 15 -tests | stats values(tests) as str | nomv str | eval str="\"".str."\"" | return $str]
The nomv command changes 'str' to a single valued field and next eval will add double qoutes around values as it'll be a space delimited string.