Why it doesn't work subsearch in eval function at the View of dashboard.

The Search in below does work in search app.

| eval val01 = [search index=A type=val01 | fields type | rename type as query | head 1]

but it doesn't work in the View of dashboard. it printed error like below.

PARSER: Applying intentions failed Error in 'eval' command: The expression is malformed. An unexpected character is reached at '[search index=_internal | fields arch | rename arch as search | head 1]'.

asked 13 Oct '11, 19:24

joy76
31●1
accept rate: 0%

edited 13 Oct '11, 19:26

If that is the error it returns, it sounds like it's another search causing the problems rather than the one you've listed here.

Eval and subsearches works, but can be tricky. Have a look at dwaddle's answer here: http://splunk-base.splunk.com/answers/31842/why-cant-i-use-subsearch-in-the-case-function-in-the-eval-command

(13 Oct '11, 22:29) Ayn

Be the first one to answer this question!

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

eval ×132
subsearch ×131

Asked: 13 Oct '11, 19:24

Seen: 282 times

Last updated: 13 Oct '11, 22:49

Why it doesn't work subsearch in eval function at the View of dashboard.

Follow this question

Splunk Resources

Related questions