Expression is malformed, eval expecting a ")"

msarro — Wed, 14 Mar 2012 01:10:37 GMT

Greetings guys.
Like my other posts today, I'm trying to find workarounds for splunk's inability to search for a literal asterisk. I am working on call detail records, in which there is a field showing the exact buttons a user pressed on their phone. For feature usage like *69, this becomes a big PITA.
For this search, the "DIALED_DIGITS" field can contain *68 or #68, one enables a feature, the other disables it.

Here is my search:

index=PHONE
|regex Dialed_Digits="(\*68|#68).*"
|eval Feature_Code=case((like(Dialed_Digits,"%68%") NOT like(Dialed_Digits,"%#68%")),"Line Feature - Enable")
|table Feature_Code

There are more feature codes to be searched for, hence using the case function. Running it returns an error stating "Error in 'eval' command: The expression is malformed. Expected )."

I have quadruple checked to make sure my syntax is correct, and have similar searches (using OR, but not NOT). I can't figure out what the issue is unless its a problem with using NOT.
Any advice would really be appreciated.

Re: Expression is malformed, eval expecting a ")"

Ayn — Wed, 14 Mar 2012 06:31:38 GMT

You need to explicitly specify the AND condition, it isn't implicitly added automatically in eval. So, instead of "... NOT like(..." you need "... AND NOT like(..."

Re: Expression is malformed, eval expecting a ")"

msarro — Wed, 14 Mar 2012 17:57:31 GMT

That worked, thank you

topic Expression is malformed, eval expecting a ")" in Splunk Search

Expression is malformed, eval expecting a ")"

Re: Expression is malformed, eval expecting a ")"

Re: Expression is malformed, eval expecting a ")"