https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command/m-p/332209#M164464 <P>This kind of thing usually turns out to be an invisible special character. </P> <P>You can either copy it to an editor where you can turn on "view invisible characters" or just retype the <CODE>| eval</CODE> code character by character. </P> <P>There is exactly one <CODE>| eval</CODE> in your code, and the error must be after an open paren <CODE>(</CODE> and before the corresponding close paren <CODE>)</CODE>, so start by just retyping the space-minus-space <CODE>-</CODE> in the middle of each parenthetical expression. </P> <P>If that doesn't work, then type over the parenthesis themselves or retype the whole <CODE>eval</CODE>.</P> Fri, 08 Dec 2017 18:39:31 GMT DalJeanis 2017-12-08T18:39:31Z https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command/m-p/332208#M164463 <P>Hi everyone i am runnig the following search and getting an error.i am sure it is something so simple that i am missing but i can't see it. can someone please help?</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/3977i19F0432245AEBA16/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>thanks in advance</P> Fri, 08 Dec 2017 17:53:26 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command/m-p/332208#M164463 carlyleadmin 2017-12-08T17:53:26Z https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command/m-p/332209#M164464 <P>This kind of thing usually turns out to be an invisible special character. </P> <P>You can either copy it to an editor where you can turn on "view invisible characters" or just retype the <CODE>| eval</CODE> code character by character. </P> <P>There is exactly one <CODE>| eval</CODE> in your code, and the error must be after an open paren <CODE>(</CODE> and before the corresponding close paren <CODE>)</CODE>, so start by just retyping the space-minus-space <CODE>-</CODE> in the middle of each parenthetical expression. </P> <P>If that doesn't work, then type over the parenthesis themselves or retype the whole <CODE>eval</CODE>.</P> Fri, 08 Dec 2017 18:39:31 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command/m-p/332209#M164464 DalJeanis 2017-12-08T18:39:31Z https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command/m-p/332210#M164465 <P>will do thanks</P> Fri, 08 Dec 2017 18:41:44 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-eval-command/m-p/332210#M164465 carlyleadmin 2017-12-08T18:41:44Z