topic Re: Error in 'eval' command: unexpected character at 86400 in Splunk Search

Error in 'eval' command: unexpected character at 86400

inventsekar — Fri, 14 May 2021 18:46:22 GMT

Hi All, On the internal logs i see this eval command error -
ERROR EvalCommand - Error in 'eval' command: The expression is malformed. An unexpected character is reached at '*)/86400)'.

but it does not provide more details like which search query / search report / alert caused this error msg.

searched about this, but no luck. could someone provide some suggestions please. thanks..

Re: Error in 'eval' command: unexpected character at 86400

richgalloway — Mon, 30 Jan 2023 18:00:55 GMT

Yes, that's one of Splunk's many crappy error messages.

If you have access to the CLI, search the savedsearches.conf files for that reported string.

find /opt/splunk/etc/apps -name savedsearches.conf -exec grep "\*)\/86400)" {} \;

If you don't have CLI access then try this SPL query

| rest /services/saved/searches splunk_server=local | search search=* | where match(search, "\*\)\/86400\)")

Re: Error in 'eval' command: unexpected character at 86400

inventsekar — Tue, 18 May 2021 12:30:01 GMT

Hi @richgalloway / Hi All.. the above rest query returns around 25 searches, i ran all of them, all are running fine.. no errors they give(on the gui, as well as on job inspector),..

1) on the internal logs, i see this error around 12 times per hour, (6 times at the hour, 6 times at the 30min).. so, just after it appears on the internal log, i login to the search head linux box, on the dispatch directory,

when i search for the search logs for this error, the correct search query which caused this log into the internal logs not showing up..

find ./ -type f -exec grep -H '/86400)' {} \;

find ./ -name search.log -exec grep -H '/86400)' {} \;

2. apart from search queries, is there anything else which might cause this errors in the internal logs?! (any field extractions, ..etc)

Re: Error in 'eval' command: unexpected character at 86400

gauravu_14 — Mon, 30 Jan 2023 17:30:28 GMT

After running the SPL query, I am getting the below error:
"Error in 'where' command: Regex: unmatched closing parenthesis"

Re: Error in 'eval' command: unexpected character at 86400

richgalloway — Mon, 30 Jan 2023 18:01:07 GMT

That's probably because of improper escaping of the embedded ')' characters. I've corrected my answer.

Re: Error in 'eval' command: unexpected character at 86400

gauravu_14 — Mon, 30 Jan 2023 18:31:47 GMT

Thanks, the SPL did work this time. However, there was no result for the mentioned string and yet I am seeing that error

Re: Error in 'eval' command: unexpected character at 86400

richgalloway — Mon, 30 Jan 2023 20:28:12 GMT

The regex may need to be adjusted. Try searching just for "86400".