Dashboards & Visualizations

Why am I getting "Error in 'where' command: The expression is malformed. Expected )" with the token for my checkbox input?

walkerhound
Path Finder

I am using a checkbox input to allow the user to choose multiple months. The checkbox makes a token called YearMonth

In my search (which is saved as the report SectionNo) I have a where clause:

|where $replace_me$ | ...

Then in my dashboard I make a search |savedsearch SectionNo replace_me=$YearMonth$

I'm using the script "showtokens.js" to see the tokens.

When $YearMonth$ looks like this: (SubmitMonthYear=201508) everything is fine.

When $YearMonth$ looks like this: (SubmitMonthYear=201508 OR SubmitMonthYear=201507) I get the following error:

Error in 'where' command: The expression is malformed.  Expected )

However if I manually replace $replace_me$ in my saved search with the value of $YearMonth$, that search works as well.

I would like to know what I'm doing wrong when the token looks like (SubmitMonthYear=201508 OR SubmitMonthYear=201507)

Thanks.

0 Karma
1 Solution

woodcock
Esteemed Legend

I think it is the whitespace that is breaking it; try these

| savedsearch SectionNo replace_me="$YearMonth$"
| savedsearch SectionNo replace_me=($YearMonth$)

View solution in original post

woodcock
Esteemed Legend

I think it is the whitespace that is breaking it; try these

| savedsearch SectionNo replace_me="$YearMonth$"
| savedsearch SectionNo replace_me=($YearMonth$)

walkerhound
Path Finder

I did find that your first suggestion works, even with the parentheses.

Thanks very much

0 Karma

walkerhound
Path Finder

Thank you for the suggestion.

I did find a work around which is simply to leave off the parentheses. If I have the token

SubmitMonthYear=201508 OR SubmitMonthYear=201507

this works.

I'm still not sure why it doesn't work with two months and parentheses.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...