https://community.splunk.com/t5/Splunk-Search/help-eval-expression-for-dynamic-field-is-invalid/m-p/482836#M135228 <P>Hi Team, </P> <P>I have below appendpipe clause <BR /> | appendpipe <BR /> [| eventstats first(eval("step3".mvindex(list_behavior,2))) as start, <STRONG>first(eval(if(isnull(mvindex(list_behavior,3))), "step4".mvindex(list_behavior,3), "exit"))</STRONG> as end by UserID]</P> <P>But I got the an error when searching<BR /> <STRONG>Error in 'eventstats' command: The eval expression for dynamic field 'eval(if(isnull(mvindex(list_behavior,3))), "step4".mvindex(list_behavior,3), "exit")' is invalid. Error='The operator at ', "Cherie", "exit"' is invalid.'.</STRONG></P> <P>I want to judge first that if the index list_behavior[3] exist or not. If exist, keep the original value, if not, fill in with "exist"</P> <P>What the correct syntax format should be here ?</P> <P>Best Regards,<BR /> Cherie</P> Wed, 30 Sep 2020 03:39:18 GMT cheriemilk 2020-09-30T03:39:18Z https://community.splunk.com/t5/Splunk-Search/help-eval-expression-for-dynamic-field-is-invalid/m-p/482836#M135228 <P>Hi Team, </P> <P>I have below appendpipe clause <BR /> | appendpipe <BR /> [| eventstats first(eval("step3".mvindex(list_behavior,2))) as start, <STRONG>first(eval(if(isnull(mvindex(list_behavior,3))), "step4".mvindex(list_behavior,3), "exit"))</STRONG> as end by UserID]</P> <P>But I got the an error when searching<BR /> <STRONG>Error in 'eventstats' command: The eval expression for dynamic field 'eval(if(isnull(mvindex(list_behavior,3))), "step4".mvindex(list_behavior,3), "exit")' is invalid. Error='The operator at ', "Cherie", "exit"' is invalid.'.</STRONG></P> <P>I want to judge first that if the index list_behavior[3] exist or not. If exist, keep the original value, if not, fill in with "exist"</P> <P>What the correct syntax format should be here ?</P> <P>Best Regards,<BR /> Cherie</P> Wed, 30 Sep 2020 03:39:18 GMT https://community.splunk.com/t5/Splunk-Search/help-eval-expression-for-dynamic-field-is-invalid/m-p/482836#M135228 cheriemilk 2020-09-30T03:39:18Z https://community.splunk.com/t5/Splunk-Search/help-eval-expression-for-dynamic-field-is-invalid/m-p/482837#M135229 <PRE><CODE>.... | appendpipe [| eventstats first(eval("step3".mvindex(list_behavior,2))) as start, first(eval(if(mvcount(list_behavior)=3, "step4".mvindex(list_behavior,3), "exit"))) as end by UserID] </CODE></PRE> <P>Hi, @cheriemilk<BR /> how about this?</P> Tue, 14 Jan 2020 09:14:01 GMT https://community.splunk.com/t5/Splunk-Search/help-eval-expression-for-dynamic-field-is-invalid/m-p/482837#M135229 to4kawa 2020-01-14T09:14:01Z