https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-an-eval-command-error-quot-The-arguments-to-the/m-p/331006#M159862 <P>It is working. Thank you very much <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 27 Jul 2017 07:14:22 GMT Taner 2017-07-27T07:14:22Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-an-eval-command-error-quot-The-arguments-to-the/m-p/331001#M159857 <P>I would like to create a new panel in my Dashboard and I am using the following search string:</P> <P>index=$index$ eventId=xy source="zz-json.log" (X-TRACE-ID="PV3*") OR (X-TRACE-ID="IPL*")| dedup X-TRACE-ID | <BR /> eval event=case( <BR /> match(X-TRACE-ID,"PV3"),"Option1", <BR /> match(X-TRACE-ID,"IPL"),"Option2") | chart count by event</P> <P>Why do I get the error message: Error in "eval" command: The arguments to the „match“ function are invalid.</P> <P>Could you please help me <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span> ?</P> Tue, 29 Sep 2020 15:03:54 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-an-eval-command-error-quot-The-arguments-to-the/m-p/331001#M159857 Taner 2020-09-29T15:03:54Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-an-eval-command-error-quot-The-arguments-to-the/m-p/331002#M159858 <P>try below, i think - in XTRACEID created a issue.</P> <P>index=$index$ eventId=xy source="zz-json.log" (X-TRACE-ID="PV3*") OR (X-TRACE-ID="IPL*")| dedup X-TRACE-ID | rename X-TRACE-ID as XTRACEID | eval event=case(<BR /> match(XTRACEID ,"PV3"),"Option1",<BR /> match(XTRACEID ,"IPL"),"Option2") | chart count by event</P> Tue, 29 Sep 2020 15:05:11 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-an-eval-command-error-quot-The-arguments-to-the/m-p/331002#M159858 sbbadri 2020-09-29T15:05:11Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-an-eval-command-error-quot-The-arguments-to-the/m-p/331003#M159859 <P>The hyphens in your field names cause Splunk to evaluate the field as the expression X minus TRACE minus ID. Try adding <CODE>| rename X-TRACE-ID as xtraceid</CODE> after your dedup and use xtraceid in your match expressions and it should work as expected.</P> Wed, 26 Jul 2017 19:02:21 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-an-eval-command-error-quot-The-arguments-to-the/m-p/331003#M159859 s2_splunk 2017-07-26T19:02:21Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-an-eval-command-error-quot-The-arguments-to-the/m-p/331004#M159860 <P>response overlap with sbbadri, sorry for the dupe</P> Wed, 26 Jul 2017 19:03:06 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-an-eval-command-error-quot-The-arguments-to-the/m-p/331004#M159860 s2_splunk 2017-07-26T19:03:06Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-an-eval-command-error-quot-The-arguments-to-the/m-p/331005#M159861 <P>You should enclose field names with special characters within single quotes in eval and where clause. Like this</P> <PRE><CODE>index=$index$ eventId=xy source="zz-json.log" (X-TRACE-ID="PV3*") OR (X-TRACE-ID="IPL*")| dedup X-TRACE-ID | eval event=case( match('X-TRACE-ID',"PV3"),"Option1", match('X-TRACE-ID',"IPL"),"Option2") | chart count by event </CODE></PRE> Wed, 26 Jul 2017 19:13:32 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-an-eval-command-error-quot-The-arguments-to-the/m-p/331005#M159861 somesoni2 2017-07-26T19:13:32Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-an-eval-command-error-quot-The-arguments-to-the/m-p/331006#M159862 <P>It is working. Thank you very much <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Thu, 27 Jul 2017 07:14:22 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-an-eval-command-error-quot-The-arguments-to-the/m-p/331006#M159862 Taner 2017-07-27T07:14:22Z