title: Splunk Query - unexpected failure when using todays date
body: <p>I have a query that has some conditional evals, when I run it for yesterday it works without errors. But when I run it for todays date, I get an unexpected character error.</p>
  <p>this works, querying yesterday</p>
  <pre><code>index=&quot;some_index&quot; sourcetype=&quot;a:b&quot; earliest=-1d@d+16h latest=-1d@d+17h app_name=&quot;SOME-BATCH-*&quot; &quot;Job completed at&quot;
  | stats count as batchJobCompleted
  | eval dfeFailures=if( batchJobCompleted &gt; 0 ,
    [search index=&quot;another_index&quot; earliest=-1d@d+16h latest=-1d@d+17h sourcetype=&quot;c:/d&quot; &quot;Summary&quot; AND &quot;RUN_TYPE: 'FOO'&quot; 
    | rex field=_raw &quot;STUFF:\s+(?&lt;STUFF&gt;\w+)&quot;
    | return $STUFF ]
    ,&quot;Not Fininshed&quot;)
  </code></pre>
  <p>change date to today, the first part works</p>
  <pre><code>index=&quot;some_index&quot; sourcetype=&quot;a:b&quot; earliest=@d+16h latest=@d+17h app_name=&quot;SOME-BATCH-*&quot; &quot;Job completed at&quot;
  | stats count as batchJobCompleted
  </code></pre>
  <p>change date to today in second search, this DOES NOT WORK</p>
  <pre><code>index=&quot;some_index&quot; sourcetype=&quot;a:b&quot; earliest=@d+16h latest=@d+17h app_name=&quot;SOME-BATCH-*&quot; &quot;Job completed at&quot;
  | stats count as batchJobCompleted
  | eval dfeFailures=if( batchJobCompleted &gt; 0 ,
    [search index=&quot;another_index&quot; earliest=@d+16h latest=@d+17h sourcetype=&quot;c:/d&quot; &quot;Summary&quot; AND &quot;RUN_TYPE: 'FOO'&quot; 
    | rex field=_raw &quot;STUFF:\s+(?&lt;STUFF&gt;\w+)&quot;
    | return $STUFF ]
    ,&quot;Not Fininshed&quot;)
  </code></pre>
  <blockquote>
  <p>Error in 'eval' command: The expression is malformed. An unexpected character is reached at ',&quot;Not Fininshed&quot;)'.
  The search job has failed due to an error. You may be able view the job in the Job Inspector.</p>
  </blockquote>