https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349635#M162317 <P>Or just check whether your user input IP contains the \" or not and proceed accordingly by removing them or not</P> Wed, 14 Mar 2018 19:08:52 GMT tiagofbmm 2018-03-14T19:08:52Z https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349629#M162311 <P>| makeresults<BR /> | eval ipaddress=192.168.1.1<BR /> | lookup AM ipaddress OUTPUT hostname<BR /> | table ipaddress,hostname<BR /> This works fine if I place the ipaddess between the double quotes other wise it throws Error in 'eval' command. The number 192.168.1.1 is invalid.</P> <P>Any clue.</P> Wed, 14 Mar 2018 18:29:26 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349629#M162311 ReachDataScient 2018-03-14T18:29:26Z https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349630#M162312 <P>IP address is a string, so it should be enclosed in double quotes. That's the syntax.</P> Wed, 14 Mar 2018 18:55:04 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349630#M162312 somesoni2 2018-03-14T18:55:04Z https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349631#M162313 <P>On a dashboard I have an input text field where user can type the IP Address and I pass this as a token to the panel search shown above. The user would never type IP Address in double quotes, so they see the Error in 'eval' command. The number 192.168.1.1 is invalid display in the panel.</P> Wed, 14 Mar 2018 19:01:48 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349631#M162313 ReachDataScient 2018-03-14T19:01:48Z https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349632#M162314 <P>When you are putting an ip address, the "." is concatenating strings that are actually numbers, hence the error like "type mismatch"</P> Wed, 14 Mar 2018 19:02:38 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349632#M162314 tiagofbmm 2018-03-14T19:02:38Z https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349633#M162315 <P>Just use "$ip_token$" and carry on. It's up to you to take care of that if the user won't type the IP between quotes</P> Wed, 14 Mar 2018 19:03:42 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349633#M162315 tiagofbmm 2018-03-14T19:03:42Z https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349634#M162316 <P>You can either update your query to use the token within quotes OR update your text box to include double quotes as prefix/suffix for that. With that, you'd need to include a label/.note in your dashboard to instruct use to NOT enter with double quotes.</P> Wed, 14 Mar 2018 19:06:37 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349634#M162316 somesoni2 2018-03-14T19:06:37Z https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349635#M162317 <P>Or just check whether your user input IP contains the \" or not and proceed accordingly by removing them or not</P> Wed, 14 Mar 2018 19:08:52 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349635#M162317 tiagofbmm 2018-03-14T19:08:52Z https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349636#M162318 <P>Wierd it works with out quotes for you .. but we should keep the value in double quotes to work..</P> <P>| eval client_ip=192.162.207.160 - The number 192.162.207.160 is invalid.<BR /> | eval client_ip="192.162.207.160" - works fine </P> Tue, 29 Sep 2020 18:27:28 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Eval-in-Search-Command-Please-help/m-p/349636#M162318 prabhu77749 2020-09-29T18:27:28Z