https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions The eval command function tostring() is valid. The tostring() function converts a numeric value to a string value. For example, tostring(3.14) returns "3.14". The other functions are not valid eval command functions.