topic Re: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'. in Splunk Search

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

sudeshna_dash — Wed, 13 Dec 2017 08:38:23 GMT

I am trying to extract a particular value from subsearch and use it to append in all the events of a particular source file.

My query is as follows:

source="c:\\splunk monitors\\log(2).txt" | eval Servtag = \"[search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^\[\n]*\[(?P[^\]]+)" | eval tag = SvcTag | return $tag]\"

Here I am using

"[search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^\[\n]*\[(?P[^\]]+)" | eval tag = SvcTag | return $tag]" subsearch to return a value "5Q4RZH2" and assign it to **Servtag**

But it is throwing an error. I dont know how to return a string from subsearch and use it to assign a variable Servtag

Re: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

niketn — Wed, 13 Dec 2017 09:39:19 GMT

@sudeshna_dash, please post the SPL by pressing the code button (one with 101010) here on Splunk Answers so that special characters do not escape. You can also give four spaces before your SPL query and add one line gap with the previous text description.

Re: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

mayurr98 — Wed, 13 Dec 2017 09:39:54 GMT

source="c:\\splunk monitors\\log(2).txt" | eval Servtag = case([search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^[\n]*[(?P[^]]+)" | eval tag = SvcTag | return 10000 tag],tag)

Also, check your rex expression. is it working fine? because I can not see field name given to extracted field in your rex expression.
put your query in code sample format.
let me know if it helps!

Re: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

sudeshna_dash — Wed, 13 Dec 2017 09:56:01 GMT

source="c:\\splunk monitors\\log(2).txt"  | eval ServiceTag = [search source="c:\\splunk monitors\\log(2).txt" | head 1 |  rex field=_raw "^[^\[\n]*\[(?P<SvcTag>[^\]]+)" | eval tag = SvcTag | return $tag ]

Re: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

mayurr98 — Wed, 13 Dec 2017 10:00:35 GMT

Try this

source="c:\\splunk monitors\\log(2).txt"  | eval ServiceTag = case([search source="c:\\splunk monitors\\log(2).txt" | head 1 |  rex field=_raw "^[^\[\n]*\[(?P<SvcTag>[^\]]+)" | eval tag = SvcTag | return 10000 tag ],tag)

let me know if it helps!

Re: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

sudeshna_dash — Wed, 13 Dec 2017 10:36:21 GMT

Thanks @mayrr98 but this is not working. I want to get the data from the "tag variable" and store it
search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^\[\n]*\[(?P<SvcTag>[^\]]+)" | eval tag = SvcTag | return $tag