https://community.splunk.com/t5/Monitoring-Splunk/eval-Error-in-eval-command-The-expression-is-malformed-Expected/m-p/459355#M5808 <P>index=abc123 | eval app=case(application==Application_1,"app_id_1",application==Application_2,"app_id_2") | stats count by app</P> <P>This search returns: Error in 'eval' command: The expression is malformed. Expected ).<BR /> Can you let me know what's wrong with my search ? Thank you</P> Tue, 29 Sep 2020 20:38:12 GMT tnguyen125 2020-09-29T20:38:12Z https://community.splunk.com/t5/Monitoring-Splunk/eval-Error-in-eval-command-The-expression-is-malformed-Expected/m-p/459355#M5808 <P>index=abc123 | eval app=case(application==Application_1,"app_id_1",application==Application_2,"app_id_2") | stats count by app</P> <P>This search returns: Error in 'eval' command: The expression is malformed. Expected ).<BR /> Can you let me know what's wrong with my search ? Thank you</P> Tue, 29 Sep 2020 20:38:12 GMT https://community.splunk.com/t5/Monitoring-Splunk/eval-Error-in-eval-command-The-expression-is-malformed-Expected/m-p/459355#M5808 tnguyen125 2020-09-29T20:38:12Z https://community.splunk.com/t5/Monitoring-Splunk/eval-Error-in-eval-command-The-expression-is-malformed-Expected/m-p/459356#M5809 <P>Hi,</P> <P>Your expression looks a bit weird in the question because you didn't use the code button and some symbols weren't escaped.<BR /> In any case, you could try with something like:</P> <PRE><CODE>index=abc123 | eval app=case ( application=="Application_1", "app_id_1", application=="Application_2", "app_id_2", 1==1, "other" ) | stats count by app </CODE></PRE> <P>Which includes a matching for the two types of application names you want to match, but also a third option which is always true in case none of the previous matches work.</P> <P>Hope that helps<BR /> J</P> Mon, 30 Jul 2018 07:55:59 GMT https://community.splunk.com/t5/Monitoring-Splunk/eval-Error-in-eval-command-The-expression-is-malformed-Expected/m-p/459356#M5809 javiergn 2018-07-30T07:55:59Z https://community.splunk.com/t5/Monitoring-Splunk/eval-Error-in-eval-command-The-expression-is-malformed-Expected/m-p/459357#M5810 <P>Hi @tnguyen125, did the answer above help? If so, please don't forget to mark it as answered. If not please provide some feedback.</P> Tue, 07 Aug 2018 18:35:50 GMT https://community.splunk.com/t5/Monitoring-Splunk/eval-Error-in-eval-command-The-expression-is-malformed-Expected/m-p/459357#M5810 javiergn 2018-08-07T18:35:50Z https://community.splunk.com/t5/Monitoring-Splunk/eval-Error-in-eval-command-The-expression-is-malformed-Expected/m-p/459358#M5811 <P>Thank you</P> Tue, 07 Aug 2018 19:06:26 GMT https://community.splunk.com/t5/Monitoring-Splunk/eval-Error-in-eval-command-The-expression-is-malformed-Expected/m-p/459358#M5811 tnguyen125 2018-08-07T19:06:26Z