Splunk Search

Error in 'UnifiedSearch': Unable to parse the 'Missing LHS for AND' search --> error when searching for surrounding events - why?

the_wolverine
Champion

Does anyone know why I am getting the following error when running the following search to find surrounding events:

* [ search sourcetype=fireeye OR sourcetype=imap | eval starttimeu=_time | eval endtimeu=_time+300 | fields + starttimeu endtimeu ]

(Seen on Splunk search head version 4.1.5)

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

Because the implicit format of the subsearch inserts the AND keyword, making the result of your subsearch ((starttimeu="1234567590" AND endtimeu="1234567890")). Splunk syntax doesn't like the AND with time quantifiers. I personally consider this a bug.

Also, starttimeu and endtimeu have been deprecated for some time now. Please use earliest and latest instead.

The fix/workaround is to use and explicit format that doesn't insert the AND (which isn't necessary anyway):

* [ search sourcetype=fireeye OR sourcetype=imap | eval earliest=_time | eval latest=_time+300 | fields earliest latest | format "(" "(" " " ")" "OR" ")" ]

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

Because the implicit format of the subsearch inserts the AND keyword, making the result of your subsearch ((starttimeu="1234567590" AND endtimeu="1234567890")). Splunk syntax doesn't like the AND with time quantifiers. I personally consider this a bug.

Also, starttimeu and endtimeu have been deprecated for some time now. Please use earliest and latest instead.

The fix/workaround is to use and explicit format that doesn't insert the AND (which isn't necessary anyway):

* [ search sourcetype=fireeye OR sourcetype=imap | eval earliest=_time | eval latest=_time+300 | fields earliest latest | format "(" "(" " " ")" "OR" ")" ]

maverick
Splunk Employee
Splunk Employee

Another workaround for this is to perform two sub-searches in succession, one of the earliest and one for the latest time values, like this:

  • [search sourcetype=syslog error |eval endtimeu = _time+300 | fields + endtimeu] [search sourcetype=syslog error |eval starttimeu = _time-300 | fields + starttimeu]
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...