Dashboards & Visualizations

Why am I getting "Error in 'where' command: The expression is malformed. Expected )" with the token for my checkbox input?

walkerhound
Path Finder

I am using a checkbox input to allow the user to choose multiple months. The checkbox makes a token called YearMonth

In my search (which is saved as the report SectionNo) I have a where clause:

|where $replace_me$ | ...

Then in my dashboard I make a search |savedsearch SectionNo replace_me=$YearMonth$

I'm using the script "showtokens.js" to see the tokens.

When $YearMonth$ looks like this: (SubmitMonthYear=201508) everything is fine.

When $YearMonth$ looks like this: (SubmitMonthYear=201508 OR SubmitMonthYear=201507) I get the following error:

Error in 'where' command: The expression is malformed.  Expected )

However if I manually replace $replace_me$ in my saved search with the value of $YearMonth$, that search works as well.

I would like to know what I'm doing wrong when the token looks like (SubmitMonthYear=201508 OR SubmitMonthYear=201507)

Thanks.

0 Karma
1 Solution

woodcock
Esteemed Legend

I think it is the whitespace that is breaking it; try these

| savedsearch SectionNo replace_me="$YearMonth$"
| savedsearch SectionNo replace_me=($YearMonth$)

View solution in original post

woodcock
Esteemed Legend

I think it is the whitespace that is breaking it; try these

| savedsearch SectionNo replace_me="$YearMonth$"
| savedsearch SectionNo replace_me=($YearMonth$)

walkerhound
Path Finder

I did find that your first suggestion works, even with the parentheses.

Thanks very much

0 Karma

walkerhound
Path Finder

Thank you for the suggestion.

I did find a work around which is simply to leave off the parentheses. If I have the token

SubmitMonthYear=201508 OR SubmitMonthYear=201507

this works.

I'm still not sure why it doesn't work with two months and parentheses.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...