topic Re: Help need to fix error "The expression is malformed. Expected LIKE." (Using rex and inputlookup) in Splunk Search

Help need to fix error "The expression is malformed. Expected LIKE." (Using rex and inputlookup)

ChrisCLewis — Tue, 29 Sep 2020 20:52:16 GMT

Hi,

I am looking for some help on how to remove the malformed expression error coming from the query below, many thanks for your time:

The test.csv has 'app' permissions and |inputlookup test.csv shows the data from the csv.
The rex command works without the search (it extracts domains from email addresses)

Job inspector has a comment of
info : No matching fields exist

Job search has this line:
WARN CalcFieldProcessor - Invalid eval expression for 'EVAL-url_length' in stanza [pan:threat]: The expression is malformed. Expected LIKE.

Re: Help need to fix error "The expression is malformed. Expected LIKE." (Using rex and inputlookup)

ChrisCLewis — Wed, 15 Aug 2018 09:38:59 GMT

For some reason the wildcards around the @ were removed when copied over the query. It should be Destination=@ , basically it is looking for emails.

Re: Help need to fix error "The expression is malformed. Expected LIKE." (Using rex and inputlookup)

richgalloway — Wed, 15 Aug 2018 10:31:52 GMT

To keep that from happening, put backticks around your code or highlight the lines and press the Code button ("101010").

Re: Help need to fix error "The expression is malformed. Expected LIKE." (Using rex and inputlookup)

richgalloway — Wed, 15 Aug 2018 10:34:34 GMT

The error is not coming from your query, at least not directly. It's caused by a faulty auto-calculated field "url_length". If you can share the pan:threat stanza from your props.conf file we may be able to say how to correct it.

Re: Help need to fix error "The expression is malformed. Expected LIKE." (Using rex and inputlookup)

ChrisCLewis — Wed, 15 Aug 2018 10:54:37 GMT

thank you for the reply, would you happen to know which folder to get it from? I can find over 20

Re: Help need to fix error "The expression is malformed. Expected LIKE." (Using rex and inputlookup)

richgalloway — Wed, 15 Aug 2018 13:04:58 GMT

Use btool. On the CLI, run $SPLUNK_HOME/bin/splunk btool -debug props list pan:threat. It will show the file(s) from which the attributes came.

Re: Help need to fix error "The expression is malformed. Expected LIKE." (Using rex and inputlookup)

gcusello — Wed, 15 Aug 2018 17:05:59 GMT

Hi ChrisCLewis,
what's "Comp"?
if you want to use a lookup in a subsearch you have to put attention that the field name of the subsearch is the same of the main search, so if in the main search you have a field called suspicious, you can use a search like this:

index="test" Policies=policy1 Destination=@
| rex max_match=0 field=Destination "(?[^@]+)@(?[^,\"\s\;]+)" 
| search [ | inputlookup test.csv | fields suspicious ]
| table ref Comp date_month

if instead the field name in the main search is different (e.g. Comp), you have to rename field in the subsearch:

index="test" Policies=policy1 Destination=@
| rex max_match=0 field=Destination "(?[^@]+)@(?[^,\"\s\;]+)" 
| search [ | inputlookup test.csv | rename suspicious AS Comp | fields Comp ]
| table ref Comp date_month

In other words in main search and in subsearch you must have the same field name.

Bye.
Giuseppe

Re: Help need to fix error "The expression is malformed. Expected LIKE." (Using rex and inputlookup)

ChrisCLewis — Thu, 23 Aug 2018 13:53:31 GMT

Thank you for your help the issues are being caused by not being able to grant the App permission to read the Lookup file & Lookup definitions