How to troubleshoot this Error in 'eval' command: The expression is malformed?

[Druffin1]

I am trying to execute a Dashboard in splunk and I'm getting this error message. It has to do time. Be is the code. Im new to splunk and having a issue with formatting the eval function. I had to commit out the CASE number but see if you can find out why the eval sttament is not woring in the query

index="salesforce" source="/informatica/pmrootdir/Splunk_SFDC_Logs/*-eventlogfile-splunk.csv" host="louapplps2024" CASE(xxxxxxxxxxxxxx) earliest=-7d latest=now (EVENT_TYPE="ApexExecution") QUIDDITY IN (R,V,W,H,X,M,L,K,I,E) IS_LONG_RUNNING_REQUEST=1 | dedup REQUEST_ID | eval oraDbTime=IF(!isnull(sdbDbTime),round(oraDbTime/1000000,0),oraDbTime) | eval dbCpuTime=IF(!isnull(sdbDbTime),round(dbCpuTime/1000000,0),dbCpuTime) | eval sdbDbTime=round(sdbDbTime/1000000,0) | eval reqIsNull=IF(isnull(requestId) AND entryPoint="TRIGGERS","YES","NO")| where reqIsNull="NO" | eval permitTime= (runTime-5000) | eval permitTimeInSecs= (permitTime/1000) | eval runTimeInSecs= (runTime/1000) | eval endTime=_time | eval startTime=(_time-runTimeInSecs) | eval conTime=(_time-permitTimeInSecs)
$org_token$ EVENT_TYPE="LightningPageView" OR EVENT_TYPE="LightningPerformance" APP_NAME="siteforce:communityApp" $userId$ $app$ | timechart span=$timespan$ dc(USER_ID) as Views

[maciep]

It's helpful if you post your search inside the code tags like below.  That may help you troubleshoot as well.  At a glance, I would say whatever is happening after your last eval is the problem.  Looks like maybe some tokens from the dashboard are just shoved in a random condition down there?

And you can always start eliminating pipes until the error goes away which can help you determine which one is problematic.  For example, remove the timehart and run the search.  Then the last eval, run the search....then next to last eval and so on.  

index="salesforce" source="/informatica/pmrootdir/Splunk_SFDC_Logs/*-eventlogfile-splunk.csv" host="louapplps2024" CASE(xxxxxxxxxxxxxx) earliest=-7d latest=now (EVENT_TYPE="ApexExecution") QUIDDITY IN (R,V,W,H,X,M,L,K,I,E) IS_LONG_RUNNING_REQUEST=1 
| dedup REQUEST_ID 
| eval oraDbTime=IF(!isnull(sdbDbTime),round(oraDbTime/1000000,0),oraDbTime) 
| eval dbCpuTime=IF(!isnull(sdbDbTime),round(dbCpuTime/1000000,0),dbCpuTime) 
| eval sdbDbTime=round(sdbDbTime/1000000,0) 
| eval reqIsNull=IF(isnull(requestId) AND entryPoint="TRIGGERS","YES","NO")
| where reqIsNull="NO" 
| eval permitTime= (runTime-5000) 
| eval permitTimeInSecs= (permitTime/1000) 
| eval runTimeInSecs= (runTime/1000) 
| eval endTime=_time 
| eval startTime=(_time-runTimeInSecs) 
| eval conTime=(_time-permitTimeInSecs)
$org_token$ EVENT_TYPE="LightningPageView" OR EVENT_TYPE="LightningPerformance" APP_NAME="siteforce:communityApp" $userId$ $app$ 
| timechart span=$timespan$ dc(USER_ID) as Views

[Druffin1]

The code runs when I use the search option

[Druffin1]

I have tried it and I am still getting he same error

[ITWhisperer · Accepted solution]

What is the value of org_token as it seems to have been appended to the eval command - is this the eval command in question?

[Druffin1]

Issue has been solved

[Druffin1]

Yes my issue has been solved

[Druffin1]

How do I check the Org_Token

[ITWhisperer]

It will be set somewhere in your dashboard - you could try adding it to title of a panel to see what the value is