Hi all,
I receive the following error when I try to run my query as a "New Search". The query runs fine without issue in my dashboard!
Error in 'eval' command: The expression is malformed. Expected ).
I've copied my query in below, replacing what could be deemed sensitive data with XXXXX.
index=XXXXXX sourcetype="XXXXXXXXX" uri_path = "/XXX/portal/screen/AjaxScreen/action/GetXXXXXX*" | bin _time span=10m | eval resp_time = mvindex(split(other," "),0) | eval resp_time_sec = (resp_time/1000000) | convert ctime(_time) as Time timeformat="%d%m %H"| stats perc50(resp_time_sec) as median_resp by _time | eval Critical = if(median_resp>4,median_resp,0) | eval Warning = if(median_resp>2.5 AND median_resp<=4 ,median_resp,0) | eval OK = if(median_resp<=2.5,median_resp,0) | table _time,Critical,Warning,OK
Could someone help shed some light why the behavior is different in the dashboard vs. Search?
