Without knowing your data or situation, I am curious as to what is keeping you or someone from creating the field extractions needed/wanted to make this work? You could also use the rex command to dynamically create fields from the raw data. Have you played with the Field Extracions page in Manager?
As for the malformed eval error, your search is quite generic to me and I don't see the error. What I do in a situation where I have a lot of evals and cannot see which one is in err is to remove all but the first and run the search, if it works, add the next one back and rerun; repeat as needed until the solution is found.