https://community.splunk.com/t5/Splunk-Search/Error-in-Case-Statement/m-p/35926#M7923 <P>Hi,</P> <P>I have a case statement as mentioned below:</P> <P>eval MODEVAL = case(mode=="modeA", if (FieldA!=0,FieldA/1024,NULL),mode=="modeB",lookup csv_modes Header1 AS mode_name OUTPUT mode)</P> <P>I get an error. "Error in 'eval' command: The expression is malformed. Expected )."</P> <P>If i replace the lookup with NULL part in the above expression, it works fine.<BR /> eval MODEVAL = case(mode=="modeA", if (FieldA!=0,FieldA/1024,NULL),mode=="modeB",NULL)</P> <P>My CSV file is:</P> <PRE><CODE>Header1,Header2 A,1 B,2 </CODE></PRE> <P>I even changed CSV to:</P> <PRE><CODE>"Header1","Header2" "A","1" "B","2" </CODE></PRE> <P>I get same error.</P> <P>Please help.</P> <P>Thanks<BR /> Strive</P> Mon, 28 Sep 2020 12:48:43 GMT strive 2020-09-28T12:48:43Z https://community.splunk.com/t5/Splunk-Search/Error-in-Case-Statement/m-p/35926#M7923 <P>Hi,</P> <P>I have a case statement as mentioned below:</P> <P>eval MODEVAL = case(mode=="modeA", if (FieldA!=0,FieldA/1024,NULL),mode=="modeB",lookup csv_modes Header1 AS mode_name OUTPUT mode)</P> <P>I get an error. "Error in 'eval' command: The expression is malformed. Expected )."</P> <P>If i replace the lookup with NULL part in the above expression, it works fine.<BR /> eval MODEVAL = case(mode=="modeA", if (FieldA!=0,FieldA/1024,NULL),mode=="modeB",NULL)</P> <P>My CSV file is:</P> <PRE><CODE>Header1,Header2 A,1 B,2 </CODE></PRE> <P>I even changed CSV to:</P> <PRE><CODE>"Header1","Header2" "A","1" "B","2" </CODE></PRE> <P>I get same error.</P> <P>Please help.</P> <P>Thanks<BR /> Strive</P> Mon, 28 Sep 2020 12:48:43 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Case-Statement/m-p/35926#M7923 strive 2020-09-28T12:48:43Z https://community.splunk.com/t5/Splunk-Search/Error-in-Case-Statement/m-p/35927#M7924 <P>Uh, that's not valid syntax for eval/case at all. You can't use just any command in the statement, it has to be one of those functions supported by eval.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions</A></P> Thu, 15 Nov 2012 17:02:47 GMT https://community.splunk.com/t5/Splunk-Search/Error-in-Case-Statement/m-p/35927#M7924 Ayn 2012-11-15T17:02:47Z