Splunk Search

sub search and regular search does not return the same value

matansocher
Contributor

Hi

I get the weird result when trying to run the same search in a subsearch and in a regular search.
This is my search:

| inputcsv MilestonesMPS 
| search Design_Element_Name="QUP v3" TASK_SOC_NAME="Napali" Report_Milestone="*P1*" 
| return $TaskDeadline

When I run it as a regular search on its own it returns: "01-02-16", which is the right data.
When I run it as a sub search like that, the result in "p1Date" field is: "-17":

| inputcsv MilestonesMPS 
| search Design_Element_Name="QUP v3" TASK_SOC_NAME="Napali" Report_Milestone="*P*"

| eval p1Date = 
    [| inputcsv MilestonesMPS 
    | search Design_Element_Name="QUP v3" TASK_SOC_NAME="Napali" Report_Milestone="*P1*" 
    | return $TaskDeadline] 

| table Design_Element_Name TASK_SOC_NAME p1Date

What is happening here?

Thanks

0 Karma
1 Solution

HiroshiSatoh
Champion

Arithmetically calculated by EVAL is -17.
p1Date = 1 - 2 - 16 =-17
Is -17 useless?

Try this!
| eval p1Date =
[| inputcsv MilestonesMPS
| search Design_Element_Name="QUP v3" TASK_SOC_NAME="Napali" Report_Milestone="P1"
|head 1| table TaskDeadline |rename TaskDeadline as query]

View solution in original post

0 Karma

HiroshiSatoh
Champion

Arithmetically calculated by EVAL is -17.
p1Date = 1 - 2 - 16 =-17
Is -17 useless?

Try this!
| eval p1Date =
[| inputcsv MilestonesMPS
| search Design_Element_Name="QUP v3" TASK_SOC_NAME="Napali" Report_Milestone="P1"
|head 1| table TaskDeadline |rename TaskDeadline as query]

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...