https://community.splunk.com/t5/Splunk-Search/Error-on-using-eval-in-a-subsearch/m-p/9470#M138 <P>Ah, yes. Quoting of double-quote characters and backslashes inside of rex strings is going to be confusing and problematic. I'd advise you if you're doing this to put the regexes into props.conf/transforms.conf and use the "extract" command to call them. If they're in the file, you can use plain PCRE syntax without worrying about how they might get transformed and passed inside the string.</P> Sun, 24 Jan 2010 04:18:38 GMT gkanapathy 2010-01-24T04:18:38Z https://community.splunk.com/t5/Splunk-Search/Error-on-using-eval-in-a-subsearch/m-p/9467#M135 <P>What is wrong with the way I'm using eval here?</P> <PRE><CODE>source="/some.audit.log" "End" "/foo/baz" | rex field=_raw "(?P&lt;ReqId&gt;\bREQ\w{32}\b)" | rex field=_raw "(?P&lt;IpAddress&gt;\b[\d]{1,3}\.[\d]{1,3}\.[\d]{1,3}\.[\d]{1,3}\b)" | rex field=_raw "(?i) End \"(?P&lt;Lid&gt;[^\"]*)\"" | rex field=_raw "[^ ] (?P&lt;HostName&gt;\w+\.\w+\.\w+) [^ ]" | fields ReqId, Lid, HostName, IpAddress | join ReqId [search source="/some.error.log" "Fail" "BLOCK" | rex field=_raw "(?P&lt;ReqId&gt;\bREQ\w{32}\b)" | rex field=_raw "Status (?P&lt;Status&gt;\b\w*\b)" | eval raw1=_raw | fields ReqId, Status, raw1 ] </CODE></PRE> <P>I got this error message</P> <P>Error in 'eval' command: Failed to parse arguments. eval usage: eval dest_key = expression</P> Sat, 23 Jan 2010 08:27:11 GMT https://community.splunk.com/t5/Splunk-Search/Error-on-using-eval-in-a-subsearch/m-p/9467#M135 dinh 2010-01-23T08:27:11Z https://community.splunk.com/t5/Splunk-Search/Error-on-using-eval-in-a-subsearch/m-p/9468#M136 <P>Just trying to pull a few of the rex out, it looks like something in this line is causing it but I'm not sure what.</P> <P>| rex field=_raw "(?i) End \"(?P<LID>[^\"]*)\""</LID></P> Sat, 23 Jan 2010 08:47:01 GMT https://community.splunk.com/t5/Splunk-Search/Error-on-using-eval-in-a-subsearch/m-p/9468#M136 dinh 2010-01-23T08:47:01Z https://community.splunk.com/t5/Splunk-Search/Error-on-using-eval-in-a-subsearch/m-p/9469#M137 <P>turns out this was the problem: [^\"]*</P> Sat, 23 Jan 2010 08:50:34 GMT https://community.splunk.com/t5/Splunk-Search/Error-on-using-eval-in-a-subsearch/m-p/9469#M137 dinh 2010-01-23T08:50:34Z https://community.splunk.com/t5/Splunk-Search/Error-on-using-eval-in-a-subsearch/m-p/9470#M138 <P>Ah, yes. Quoting of double-quote characters and backslashes inside of rex strings is going to be confusing and problematic. I'd advise you if you're doing this to put the regexes into props.conf/transforms.conf and use the "extract" command to call them. If they're in the file, you can use plain PCRE syntax without worrying about how they might get transformed and passed inside the string.</P> Sun, 24 Jan 2010 04:18:38 GMT https://community.splunk.com/t5/Splunk-Search/Error-on-using-eval-in-a-subsearch/m-p/9470#M138 gkanapathy 2010-01-24T04:18:38Z https://community.splunk.com/t5/Splunk-Search/Error-on-using-eval-in-a-subsearch/m-p/9471#M139 <P>Where can I find the documentation on how to implement it this way?</P> Mon, 25 Jan 2010 07:54:01 GMT https://community.splunk.com/t5/Splunk-Search/Error-on-using-eval-in-a-subsearch/m-p/9471#M139 dinh 2010-01-25T07:54:01Z https://community.splunk.com/t5/Splunk-Search/Error-on-using-eval-in-a-subsearch/m-p/9472#M140 <P>The "extract" command docs and the docs for the transforms.conf file should do it. You define it in transforms.conf, then call it on demand using the "extract" command (instead of "rex"). You could use props.conf to make it run automatically for the sourcetype as well.</P> <P>BTW I would not use macros.conf for this particular case, since it adds a whole new layer of escaping and parsing.</P> Wed, 27 Jan 2010 09:20:10 GMT https://community.splunk.com/t5/Splunk-Search/Error-on-using-eval-in-a-subsearch/m-p/9472#M140 gkanapathy 2010-01-27T09:20:10Z