Splunk Search

Error in Eval in Search Command. Please help.

ReachDataScient
Explorer

| makeresults
| eval ipaddress=192.168.1.1
| lookup AM ipaddress OUTPUT hostname
| table ipaddress,hostname
This works fine if I place the ipaddess between the double quotes other wise it throws Error in 'eval' command. The number 192.168.1.1 is invalid.

Any clue.

Tags (1)
0 Karma
1 Solution

tiagofbmm
Influencer

When you are putting an ip address, the "." is concatenating strings that are actually numbers, hence the error like "type mismatch"

View solution in original post

0 Karma

prabhu77749
Explorer

Wierd it works with out quotes for you .. but we should keep the value in double quotes to work..

| eval client_ip=192.162.207.160 - The number 192.162.207.160 is invalid.
| eval client_ip="192.162.207.160" - works fine

0 Karma

tiagofbmm
Influencer

When you are putting an ip address, the "." is concatenating strings that are actually numbers, hence the error like "type mismatch"

0 Karma

somesoni2
SplunkTrust
SplunkTrust

IP address is a string, so it should be enclosed in double quotes. That's the syntax.

0 Karma

ReachDataScient
Explorer

On a dashboard I have an input text field where user can type the IP Address and I pass this as a token to the panel search shown above. The user would never type IP Address in double quotes, so they see the Error in 'eval' command. The number 192.168.1.1 is invalid display in the panel.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You can either update your query to use the token within quotes OR update your text box to include double quotes as prefix/suffix for that. With that, you'd need to include a label/.note in your dashboard to instruct use to NOT enter with double quotes.

0 Karma

tiagofbmm
Influencer

Or just check whether your user input IP contains the \" or not and proceed accordingly by removing them or not

0 Karma

tiagofbmm
Influencer

Just use "$ip_token$" and carry on. It's up to you to take care of that if the user won't type the IP between quotes

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...