topic Re: Error in 'where' command: The expression is malformed. Expected ). in Splunk Search

Error in 'where' command: The expression is malformed. Expected ).

sumarri — Mon, 15 Apr 2024 14:14:50 GMT

So I am creating a dashboard and I keep getting this error:

Error in 'where' command: The expression is malformed. Expected ).

This is what I have:

| loadjob savedsearch="name:search:cust_info" | where AccountType IN ($AccountType$)

I created a multiselect filter on AccountType and I want the SPL to query on those selected.

What could I be missing or another way to achieve this query to filter on AccountType?

Re: Error in 'where' command: The expression is malformed. Expected ).

richgalloway — Mon, 15 Apr 2024 14:11:47 GMT

The IN operator only works in the search command. In where you must use the in function.

| loadjob savedsearch="name:search:cust_info" | where in(AccountType,$AccountType$)

Re: Error in 'where' command: The expression is malformed. Expected ).

sumarri — Mon, 15 Apr 2024 14:15:45 GMT

Hey! I still get the same error. But thank you for trying! Let me know if something else clicks. Thank you.

Re: Error in 'where' command: The expression is malformed. Expected ).

richgalloway — Mon, 15 Apr 2024 14:38:20 GMT

What does the $AccountType$ token expand to?

Re: Error in 'where' command: The expression is malformed. Expected ).

sumarri — Mon, 15 Apr 2024 14:40:11 GMT

So, it is expected to get the AccountTypes selected from the user on the dashboard from the multiselect filter.

Re: Error in 'where' command: The expression is malformed. Expected ).

sumarri — Mon, 15 Apr 2024 15:54:39 GMT

I have soled the issue.

I needed to add quotes to the AccountType:

| where AccountType IN ("$AccountType$")

I also needed to change the delimiter:

This solved the problem for me! Thank you!