https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-expression-is-malformed-An-unexpected/m-p/391939#M114096 <P>@MuS, it was only yesterday that @xpac and I spoke of the devil <CODE>“</CODE> <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> <P><A href="https://answers.splunk.com/answers/659050/unicode-characters-in-dashboardssearches.html#answer-659052">https://answers.splunk.com/answers/659050/unicode-characters-in-dashboardssearches.html#answer-659052</A></P> Wed, 16 May 2018 05:35:34 GMT niketn 2018-05-16T05:35:34Z https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-expression-is-malformed-An-unexpected/m-p/391937#M114094 <P>I was getting when I run the below query, can someone give me the solution pls,</P> <P>below is my query:</P> <P>| convert num(actualTimeExtract) as actualTime<BR /> |eval buckt=case (<BR /> actualTime&lt;1001, “time &lt; 1 sec”, <BR /> actualTime&gt;1000 AND actualTime&lt;5001, “1 &lt; time &lt; 5”, <BR /> 1=1, “time &gt; 15”)<BR /> |stats dc(hdr.macaddress) by buckt</P> Tue, 15 May 2018 23:17:12 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-expression-is-malformed-An-unexpected/m-p/391937#M114094 sarathipattam 2018-05-15T23:17:12Z https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-expression-is-malformed-An-unexpected/m-p/391938#M114095 <P>Hi sarathipattam,</P> <P>this is most likely a copy/paste problem, you have <CODE>“</CODE> instead of <CODE>"</CODE>. Try the run everywhere search below to see how it works:</P> <PRE><CODE>| makeresults | eval actualTime="1000" | eval buckt=case ( actualTime&lt;1001, "time &lt; 1 sec", actualTime&gt;1000 AND actualTime&lt;5001, "1 &lt; time &lt; 5", 1=1, "time &gt; 15") </CODE></PRE> <P>Hope this helps ...</P> <P>cheers, MuS</P> Wed, 16 May 2018 00:19:03 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-expression-is-malformed-An-unexpected/m-p/391938#M114095 MuS 2018-05-16T00:19:03Z https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-expression-is-malformed-An-unexpected/m-p/391939#M114096 <P>@MuS, it was only yesterday that @xpac and I spoke of the devil <CODE>“</CODE> <span class="lia-unicode-emoji" title=":grinning_face_with_smiling_eyes:">😄</span></P> <P><A href="https://answers.splunk.com/answers/659050/unicode-characters-in-dashboardssearches.html#answer-659052">https://answers.splunk.com/answers/659050/unicode-characters-in-dashboardssearches.html#answer-659052</A></P> Wed, 16 May 2018 05:35:34 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command-The-expression-is-malformed-An-unexpected/m-p/391939#M114096 niketn 2018-05-16T05:35:34Z