Dashboards & Visualizations

Why am I getting "Error in 'where' command: The expression is malformed. Expected )" with the token for my checkbox input?

walkerhound
Path Finder

I am using a checkbox input to allow the user to choose multiple months. The checkbox makes a token called YearMonth

In my search (which is saved as the report SectionNo) I have a where clause:

|where $replace_me$ | ...

Then in my dashboard I make a search |savedsearch SectionNo replace_me=$YearMonth$

I'm using the script "showtokens.js" to see the tokens.

When $YearMonth$ looks like this: (SubmitMonthYear=201508) everything is fine.

When $YearMonth$ looks like this: (SubmitMonthYear=201508 OR SubmitMonthYear=201507) I get the following error:

Error in 'where' command: The expression is malformed.  Expected )

However if I manually replace $replace_me$ in my saved search with the value of $YearMonth$, that search works as well.

I would like to know what I'm doing wrong when the token looks like (SubmitMonthYear=201508 OR SubmitMonthYear=201507)

Thanks.

0 Karma
1 Solution

woodcock
Esteemed Legend

I think it is the whitespace that is breaking it; try these

| savedsearch SectionNo replace_me="$YearMonth$"
| savedsearch SectionNo replace_me=($YearMonth$)

View solution in original post

woodcock
Esteemed Legend

I think it is the whitespace that is breaking it; try these

| savedsearch SectionNo replace_me="$YearMonth$"
| savedsearch SectionNo replace_me=($YearMonth$)

walkerhound
Path Finder

I did find that your first suggestion works, even with the parentheses.

Thanks very much

0 Karma

walkerhound
Path Finder

Thank you for the suggestion.

I did find a work around which is simply to leave off the parentheses. If I have the token

SubmitMonthYear=201508 OR SubmitMonthYear=201507

this works.

I'm still not sure why it doesn't work with two months and parentheses.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...