Dashboards & Visualizations

Why am I getting "Error in 'where' command: The expression is malformed. Expected )" with the token for my checkbox input?

walkerhound
Path Finder

I am using a checkbox input to allow the user to choose multiple months. The checkbox makes a token called YearMonth

In my search (which is saved as the report SectionNo) I have a where clause:

|where $replace_me$ | ...

Then in my dashboard I make a search |savedsearch SectionNo replace_me=$YearMonth$

I'm using the script "showtokens.js" to see the tokens.

When $YearMonth$ looks like this: (SubmitMonthYear=201508) everything is fine.

When $YearMonth$ looks like this: (SubmitMonthYear=201508 OR SubmitMonthYear=201507) I get the following error:

Error in 'where' command: The expression is malformed.  Expected )

However if I manually replace $replace_me$ in my saved search with the value of $YearMonth$, that search works as well.

I would like to know what I'm doing wrong when the token looks like (SubmitMonthYear=201508 OR SubmitMonthYear=201507)

Thanks.

0 Karma
1 Solution

woodcock
Esteemed Legend

I think it is the whitespace that is breaking it; try these

| savedsearch SectionNo replace_me="$YearMonth$"
| savedsearch SectionNo replace_me=($YearMonth$)

View solution in original post

woodcock
Esteemed Legend

I think it is the whitespace that is breaking it; try these

| savedsearch SectionNo replace_me="$YearMonth$"
| savedsearch SectionNo replace_me=($YearMonth$)

walkerhound
Path Finder

I did find that your first suggestion works, even with the parentheses.

Thanks very much

0 Karma

walkerhound
Path Finder

Thank you for the suggestion.

I did find a work around which is simply to leave off the parentheses. If I have the token

SubmitMonthYear=201508 OR SubmitMonthYear=201507

this works.

I'm still not sure why it doesn't work with two months and parentheses.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...