topic Re: Error in 'eval' command: The expression is malformed. in Splunk Search

Error in 'eval' command: The expression is malformed.

KeaganJ — Thu, 03 Sep 2020 09:25:57 GMT

I am getting the following error on my application/dashboard:
" Error in 'eval' command: The expression is malformed."

The query that is being triggered is:

| makeresults count=1 | eval id=$incident_id$| sendalert canary_acknowledge_incident param.incident_id=$incident_id$ param.index_name="main"

And this is getting triggered when a Submit Button is being clicked.

The Submit button is tied to a Dropdown of values.

The dropdown is populated with values and is defined as below:

<input type="dropdown" token="incident_id" searchWhenChanged="false"> <label>Incident to Close</label> <fieldForLabel>id</fieldForLabel> <fieldForValue>id</fieldForValue> <search> <query>`canary_tools_index` sourcetype="canarytools:incidents" | stats values(id) as id| mvexpand id</query> <earliest>-30d@d</earliest> <latest>now</latest> </search> </input>

And running that drop down populating query using the Search tool gives information such as:

incident:canarytoken:80f36193721b94fb268bb6df:<source_ip>:<epoch_timestamp>

Looking at previous questions asked on this forum point towards the field names of the `eval` command not working whenever they start with a numeric character. But this is not the case in my issues as I am using :
`eval id=$incident_id$`

This is happening on Splunk 8.0.0

Re: Error in 'eval' command: The expression is malformed.

gcusello — Thu, 03 Sep 2020 09:35:18 GMT

Hi @KeaganJ,

try to add quotes to the eval and sendalert commands:

| makeresults count=1 | eval id="$incident_id$" | sendalert canary_acknowledge_incident param.incident_id="$incident_id$" param.index_name="main"

Ciao.

Giuseppe

Re: Error in 'eval' command: The expression is malformed.

KeaganJ — Thu, 03 Sep 2020 09:45:43 GMT

I managed to fix my issue by surrounding the variable in double quotes ie:

eval id="$incident_id$"

Re: Error in 'eval' command: The expression is malformed.

gcusello — Thu, 03 Sep 2020 09:52:15 GMT

Hi @KeaganJ,

good!

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉

Re: Error in 'eval' command: The expression is malformed.

KeaganJ — Thu, 03 Sep 2020 09:52:56 GMT

Thanks Giuseppe Just saw your reply now as I refreshed the page. Your solution works great for me.