topic Re: Why am I getting an error in 'eval' command "The expression is malformed. Expected ). No missing Parenthesis"? in Splunk Search

Why am I getting an error in 'eval' command "The expression is malformed. Expected ). No missing Parenthesis"?

cacampbe — Fri, 27 Jul 2018 18:31:35 GMT

I have double and triple checked for parenthesis and found no issues with the code.

<row>
    <panel>
      <title>VM Usage</title>
      <input type="dropdown" token="TimeRange" searchWhenChanged="true">
        <label>Select a Time Range for the X-axis:</label>
        <choice value="-7d@d">last 7 days</choice>
        <choice value="-30d@d">last 30 days</choice>
        <choice value="-12mon@mon">last 12 months</choice>
        <default>-7d@d</default>
        <initialValue>-7d@d</initialValue>
      </input>
      <input type="dropdown" token="VMtype" searchWhenChanged="true">
        <label>Select a VM type:</label>
        <default>ALL</default>
        <choice value="sum(BTD) as BTD,sum(PROD) as PROD, sum(SUP) as SUP, sum(SP) as SurePayroll, first(BTDthreshold) as BTDMAX, first(Prodthreshold) as PRODMAX, first(SUPthreshold) as SUPMAX, first(SPthreshold) as SPMAX">ALL</choice>
        <choice value="sum(BTD) as BTD, first(BTDthreshold) as BTDMAX">BTD</choice>
        <choice value="sum(PROD) as PROD, first(Prodthreshold) as PRODMAX">PROD</choice>
        <choice value="sum(SUP) as SUP, first(SUPthreshold) as SUPMAX">SUP</choice>
        <choice value="sum(SP) as SurePayroll, first(SPthreshold) as SPMAX">Sure Payroll</choice>
      </input>
      <chart>
        <title>VM usage (Bars = Total test durations, Lines = Max capacity of VM type)</title>
        <search>
          <query>index=taf sourcetype=dbmon source=PROD_host_TAFPRODLSNR_db_AutomationDW_ExecutionHistory ExecutedByUser="PAYCHEX\\TafRunProd"|eval MONTH=strftime(_time,"%m")|eval DAY = strftime(_time,"%d")|
eval time = if(match($TimeRange$,"-12mon@mon"),MONTH,DAY) |eval Duration=round(Duration/600000000,1)|
eval BTD = if("TAF-BTD"==substr(Computer,1,7),Duration,0)|eval PROD = if("TAF-P"==substr(Computer,1,5),Duration,0))|eval SUP = if("TAF-SUP"==substr(Computer,1,7),Duration,0)|eval SP = if("TAF-SP"==substr(Computer,1,6)),Duration,0)|
eval VMMAX = if(match($TimeRange$,"-12mon@mon"),17280,1440)|eval BTDthreshold = 70*VMMAX|eval Prodthreshold = 115*VMMAX|eval SUPthreshold = 65*VMMAX|eval SPthreshold = 23*VMMAX|
stats $VMtype$ by time</query>
          <earliest>$TimeRange$</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.axisTitleY.text">Duration (min)</option>
        <option name="charting.chart">column</option>
        <option name="charting.chart.overlayFields">BTDMAX,PRODMAX,SUPMAX,SPMAX</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.fieldColors">{"BTDMAX":0xcc0000,"BTD":0xcc0000,"PRODMAX":0x009900,"PROD":0x009900,"SUPMAX":0x0000FF,"SUP":0x0000FF,"SPMAX":0xFF9900,"SurePayroll":0xFF9900}</option>
      </chart>
    </panel>
  </row>

Re: Why am I getting an error in 'eval' command "The expression is malformed. Expected ). No missing Parenthesis"?

sudosplunk — Fri, 27 Jul 2018 18:45:56 GMT

Hi there,

I found two errors in your search query.

You have an extra closing ) in the 6th eval statement - | eval PROD = if("TAF-P"==substr(Computer,1,5),Duration,0))
You have an extra closing ) in the 8th eval statement - | eval SP = if("TAF-SP"==substr(Computer,1,6)),Duration,0)

Re: Why am I getting an error in 'eval' command "The expression is malformed. Expected ). No missing Parenthesis"?

thambisetty — Fri, 27 Jul 2018 18:47:36 GMT

Hi,

try below query,

index=taf sourcetype=dbmon source=PROD_host_TAFPRODLSNR_db_AutomationDW_ExecutionHistory ExecutedByUser="PAYCHEX\\TafRunProd"
|eval MONTH=strftime(_time,"%m"),DAY = strftime(_time,"%d"),time = if(match($TimeRange$,"-12mon@mon"),MONTH,DAY),Duration=round(Duration/600000000,1),BTD = if("TAF-BTD"==substr(Computer,1,7),Duration,0),PROD = if("TAF-P"==substr(Computer,1,5),Duration,0),SUP = if("TAF-SUP"==substr(Computer,1,7),Duration,0),SP = if("TAF-SP"==substr(Computer,1,6),Duration,0),VMMAX = if(match($TimeRange$,"-12mon@mon"),17280,1440),BTDthreshold = 70*VMMAX,Prodthreshold = 115*VMMAX,SUPthreshold = 65*VMMAX,SPthreshold = 23*VMMAX
| stats $VMtype$ by time

Re: Why am I getting an error in 'eval' command "The expression is malformed. Expected ). No missing Parenthesis"?

somesoni2 — Fri, 27 Jul 2018 18:47:41 GMT

If the TimeRange token has string value, then put it in double quotes in eval, like this (couple of eval-match )

index=taf sourcetype=dbmon source=PROD_host_TAFPRODLSNR_db_AutomationDW_ExecutionHistory ExecutedByUser="PAYCHEX\\TafRunProd"|eval MONTH=strftime(_time,"%m")|eval DAY = strftime(_time,"%d")|
 eval time = if(match("$TimeRange$","-12mon@mon"),MONTH,DAY) |eval Duration=round(Duration/600000000,1)|
 eval BTD = if("TAF-BTD"==substr(Computer,1,7),Duration,0)|eval PROD = if("TAF-P"==substr(Computer,1,5),Duration,0))|eval SUP = if("TAF-SUP"==substr(Computer,1,7),Duration,0)|eval SP = if("TAF-SP"==substr(Computer,1,6)),Duration,0)|
 eval VMMAX = if(match("$TimeRange$","-12mon@mon"),17280,1440)|eval BTDthreshold = 70*VMMAX|eval Prodthreshold = 115*VMMAX|eval SUPthreshold = 65*VMMAX|eval SPthreshold = 23*VMMAX|
 stats $VMtype$ by time

Re: Why am I getting an error in 'eval' command "The expression is malformed. Expected ). No missing Parenthesis"?

cacampbe — Fri, 27 Jul 2018 18:51:11 GMT

Thanks, in my efforts to solve it myself I had added extra ) because I was losing my mind, and forgot a couple when taking them back out.

Re: Why am I getting an error in 'eval' command "The expression is malformed. Expected ). No missing Parenthesis"?

cacampbe — Fri, 27 Jul 2018 18:51:40 GMT

That fixed it! thanks!

Re: Why am I getting an error in 'eval' command "The expression is malformed. Expected ). No missing Parenthesis"?

sudosplunk — Fri, 27 Jul 2018 18:54:41 GMT

I see ya. I've been there couple of times:)
Happy Splunking!