https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615634#M50539 <P>Issue has been solved</P> Mon, 03 Oct 2022 11:41:28 GMT Druffin1 2022-10-03T11:41:28Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615177#M50469 <P>I am trying to execute a Dashboard in splunk and I'm getting this error message. It has to do time. Be is the code. Im new to splunk and having a issue with formatting the eval function. I had to commit out the CASE number but see if you can find out why the eval sttament is not woring in the query</P> <P>&nbsp;</P> <LI-CODE lang="markup">index="salesforce" source="/informatica/pmrootdir/Splunk_SFDC_Logs/*-eventlogfile-splunk.csv" host="louapplps2024" CASE(xxxxxxxxxxxxxx) earliest=-7d latest=now (EVENT_TYPE="ApexExecution") QUIDDITY IN (R,V,W,H,X,M,L,K,I,E) IS_LONG_RUNNING_REQUEST=1 | dedup REQUEST_ID | eval oraDbTime=IF(!isnull(sdbDbTime),round(oraDbTime/1000000,0),oraDbTime) | eval dbCpuTime=IF(!isnull(sdbDbTime),round(dbCpuTime/1000000,0),dbCpuTime) | eval sdbDbTime=round(sdbDbTime/1000000,0) | eval reqIsNull=IF(isnull(requestId) AND entryPoint="TRIGGERS","YES","NO")| where reqIsNull="NO" | eval permitTime= (runTime-5000) | eval permitTimeInSecs= (permitTime/1000) | eval runTimeInSecs= (runTime/1000) | eval endTime=_time | eval startTime=(_time-runTimeInSecs) | eval conTime=(_time-permitTimeInSecs) $org_token$ EVENT_TYPE="LightningPageView" OR EVENT_TYPE="LightningPerformance" APP_NAME="siteforce:communityApp" $userId$ $app$ | timechart span=$timespan$ dc(USER_ID) as Views</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp;</P> Thu, 29 Sep 2022 14:56:57 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615177#M50469 Druffin1 2022-09-29T14:56:57Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615178#M50470 <P>What is the value of org_token as it seems to have been appended to the eval command - is this the eval command in question?</P> Thu, 29 Sep 2022 11:56:19 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615178#M50470 ITWhisperer 2022-09-29T11:56:19Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615180#M50471 <P>It's helpful if you post your search inside the code tags like below.&nbsp; That may help you troubleshoot as well.&nbsp; At a glance, I would say whatever is happening after your last eval is the problem.&nbsp; Looks like maybe some tokens from the dashboard are just shoved in a random condition down there?<BR /><BR /></P><P>And you can always start eliminating pipes until the error goes away which can help you determine which one is problematic.&nbsp; For example, remove the timehart and run the search.&nbsp; Then the last eval, run the search....then next to last eval and so on.&nbsp;&nbsp;</P><LI-CODE lang="markup">index="salesforce" source="/informatica/pmrootdir/Splunk_SFDC_Logs/*-eventlogfile-splunk.csv" host="louapplps2024" CASE(xxxxxxxxxxxxxx) earliest=-7d latest=now (EVENT_TYPE="ApexExecution") QUIDDITY IN (R,V,W,H,X,M,L,K,I,E) IS_LONG_RUNNING_REQUEST=1 | dedup REQUEST_ID | eval oraDbTime=IF(!isnull(sdbDbTime),round(oraDbTime/1000000,0),oraDbTime) | eval dbCpuTime=IF(!isnull(sdbDbTime),round(dbCpuTime/1000000,0),dbCpuTime) | eval sdbDbTime=round(sdbDbTime/1000000,0) | eval reqIsNull=IF(isnull(requestId) AND entryPoint="TRIGGERS","YES","NO") | where reqIsNull="NO" | eval permitTime= (runTime-5000) | eval permitTimeInSecs= (permitTime/1000) | eval runTimeInSecs= (runTime/1000) | eval endTime=_time | eval startTime=(_time-runTimeInSecs) | eval conTime=(_time-permitTimeInSecs) $org_token$ EVENT_TYPE="LightningPageView" OR EVENT_TYPE="LightningPerformance" APP_NAME="siteforce:communityApp" $userId$ $app$ | timechart span=$timespan$ dc(USER_ID) as Views</LI-CODE><P>&nbsp;</P> Thu, 29 Sep 2022 11:58:02 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615180#M50471 maciep 2022-09-29T11:58:02Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615208#M50473 <P>I have tried it and I am still getting he same error</P> Thu, 29 Sep 2022 13:45:44 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615208#M50473 Druffin1 2022-09-29T13:45:44Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615209#M50474 <P>How do I check the Org_Token</P> Thu, 29 Sep 2022 13:46:20 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615209#M50474 Druffin1 2022-09-29T13:46:20Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615210#M50475 <P>It will be set somewhere in your dashboard - you could try adding it to title of a panel to see what the value is</P> Thu, 29 Sep 2022 13:49:15 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615210#M50475 ITWhisperer 2022-09-29T13:49:15Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615224#M50476 <P>The code runs when I use the search option</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 29 Sep 2022 14:15:57 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615224#M50476 Druffin1 2022-09-29T14:15:57Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615633#M50538 <P>Yes my issue has been solved</P> Mon, 03 Oct 2022 11:41:13 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615633#M50538 Druffin1 2022-10-03T11:41:13Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615634#M50539 <P>Issue has been solved</P> Mon, 03 Oct 2022 11:41:28 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-troubleshoot-this-Error-in-eval-command-The-expression-is/m-p/615634#M50539 Druffin1 2022-10-03T11:41:28Z