https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-Error-in-eval-command-The-expression-is/m-p/283447#M85658 <P>There seems to be a typo in your code and you need to use "where" instead of "search" when comparing fields:</P> <PRE><CODE>Code |eval tmp="$ID$" | eval tmp=if(isnull(tmp),"",tmp) | where Instance_ID = tmp </CODE></PRE> <P>You can also use the match operator. See <A href="https://answers.splunk.com/answers/54063/compare-fields-for-like-match.html">this</A> post</P> Thu, 17 Dec 2015 16:09:19 GMT javiergn 2015-12-17T16:09:19Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-Error-in-eval-command-The-expression-is/m-p/283446#M85657 <P><STRONG>Instance_ID</STRONG> is one extracted field in code <CODE>*</CODE>. If there is a value in the <CODE>$ID$</CODE> field, then result should list only for that value, else as default, it should display results for all values (for all values, I am trying <CODE>*</CODE> to tmp)</P> <PRE><CODE>Code *|eval tmp="$ID$" | eval tmp=if(isnull(tmp),"*",tmp |search Instance_ID = tmp </CODE></PRE> Thu, 17 Dec 2015 07:57:13 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-Error-in-eval-command-The-expression-is/m-p/283446#M85657 sunil_bansal 2015-12-17T07:57:13Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-Error-in-eval-command-The-expression-is/m-p/283447#M85658 <P>There seems to be a typo in your code and you need to use "where" instead of "search" when comparing fields:</P> <PRE><CODE>Code |eval tmp="$ID$" | eval tmp=if(isnull(tmp),"",tmp) | where Instance_ID = tmp </CODE></PRE> <P>You can also use the match operator. See <A href="https://answers.splunk.com/answers/54063/compare-fields-for-like-match.html">this</A> post</P> Thu, 17 Dec 2015 16:09:19 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-Error-in-eval-command-The-expression-is/m-p/283447#M85658 javiergn 2015-12-17T16:09:19Z https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-Error-in-eval-command-The-expression-is/m-p/283448#M85659 <P>The error is telling you that you are missing an end parenthesis in your <CODE>eval</CODE> command. So, just add one in, like this:</P> <PRE><CODE> Code *|eval tmp="$ID$" | eval tmp=if(isnull(tmp),"*",tmp) |search Instance_ID = tmp </CODE></PRE> Thu, 17 Dec 2015 18:18:19 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-quot-Error-in-eval-command-The-expression-is/m-p/283448#M85659 masonmorales 2015-12-17T18:18:19Z