Dashboards & Visualizations

Why am I getting "Error in 'where' command: The expression is malformed. Expected )" with the token for my checkbox input?

Path Finder

I am using a checkbox input to allow the user to choose multiple months. The checkbox makes a token called YearMonth

In my search (which is saved as the report SectionNo) I have a where clause:

|where $replace_me$ | ...

Then in my dashboard I make a search |savedsearch SectionNo replace_me=$YearMonth$

I'm using the script "showtokens.js" to see the tokens.

When $YearMonth$ looks like this: (SubmitMonthYear=201508) everything is fine.

When $YearMonth$ looks like this: (SubmitMonthYear=201508 OR SubmitMonthYear=201507) I get the following error:

Error in 'where' command: The expression is malformed.  Expected )

However if I manually replace $replace_me$ in my saved search with the value of $YearMonth$, that search works as well.

I would like to know what I'm doing wrong when the token looks like (SubmitMonthYear=201508 OR SubmitMonthYear=201507)

Thanks.

0 Karma
1 Solution

Esteemed Legend

I think it is the whitespace that is breaking it; try these

| savedsearch SectionNo replace_me="$YearMonth$"
| savedsearch SectionNo replace_me=($YearMonth$)

View solution in original post

Esteemed Legend

I think it is the whitespace that is breaking it; try these

| savedsearch SectionNo replace_me="$YearMonth$"
| savedsearch SectionNo replace_me=($YearMonth$)

View solution in original post

Path Finder

I did find that your first suggestion works, even with the parentheses.

Thanks very much

0 Karma

Path Finder

Thank you for the suggestion.

I did find a work around which is simply to leave off the parentheses. If I have the token

SubmitMonthYear=201508 OR SubmitMonthYear=201507

this works.

I'm still not sure why it doesn't work with two months and parentheses.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!