https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-statement-to-resolve-quot-Error-in-eval/m-p/213600#M62655 <P>You don't need <CODE>*</CODE> in your match. Match matches the string with wild cards.</P> <P>Try using</P> <PRE><CODE> eval camp = if(match(Summary,"Planned"),"mainten","other") | top limit=50 Summary,camp </CODE></PRE> Mon, 20 Jun 2016 09:32:05 GMT renjith_nair 2016-06-20T09:32:05Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-statement-to-resolve-quot-Error-in-eval/m-p/213599#M62654 <P>Hello all,</P> <P>I'm trying to filter some event by their Summary. I just want to distinguish when they have the word Maintenance and catalogue the rest as "other".</P> <P>My eval statement is this:</P> <PRE><CODE>eval camp = if(match(Summary,"*Planned*"),"mainten","other") | top limit=50 Summary,camp </CODE></PRE> <P>I'm trying with Planned because if I put "maintenance", I get this error: </P> <PRE><CODE>Error in 'eval' command: Regex: nothing to repeat </CODE></PRE> <P>but there can be planned and emergency maintenances and I want all of them as the same group.</P> <P>Any idea why and how can I resolve this error?</P> <P>Thank you in advance.</P> Mon, 20 Jun 2016 09:03:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-statement-to-resolve-quot-Error-in-eval/m-p/213599#M62654 marina_rovira 2016-06-20T09:03:56Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-statement-to-resolve-quot-Error-in-eval/m-p/213600#M62655 <P>You don't need <CODE>*</CODE> in your match. Match matches the string with wild cards.</P> <P>Try using</P> <PRE><CODE> eval camp = if(match(Summary,"Planned"),"mainten","other") | top limit=50 Summary,camp </CODE></PRE> Mon, 20 Jun 2016 09:32:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-statement-to-resolve-quot-Error-in-eval/m-p/213600#M62655 renjith_nair 2016-06-20T09:32:05Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-statement-to-resolve-quot-Error-in-eval/m-p/213601#M62656 <P>Thank you! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> It works now</P> Mon, 20 Jun 2016 09:39:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-eval-statement-to-resolve-quot-Error-in-eval/m-p/213601#M62656 marina_rovira 2016-06-20T09:39:17Z