Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Monitoring Splunk
- :
- eval - Error in 'eval' command: The expression is ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=abc123 | eval app=case(application==Application_1,"app_id_1",application==Application_2,"app_id_2") | stats count by app
This search returns: Error in 'eval' command: The expression is malformed. Expected ).
Can you let me know what's wrong with my search ? Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Your expression looks a bit weird in the question because you didn't use the code button and some symbols weren't escaped.
In any case, you could try with something like:
index=abc123
| eval app=case (
application=="Application_1", "app_id_1",
application=="Application_2", "app_id_2",
1==1, "other"
)
| stats count by app
Which includes a matching for the two types of application names you want to match, but also a third option which is always true in case none of the previous matches work.
Hope that helps
J
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Your expression looks a bit weird in the question because you didn't use the code button and some symbols weren't escaped.
In any case, you could try with something like:
index=abc123
| eval app=case (
application=="Application_1", "app_id_1",
application=="Application_2", "app_id_2",
1==1, "other"
)
| stats count by app
Which includes a matching for the two types of application names you want to match, but also a third option which is always true in case none of the previous matches work.
Hope that helps
J
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @tnguyen125, did the answer above help? If so, please don't forget to mark it as answered. If not please provide some feedback.
Data Management Digest – December 2025
Index This | What is broken 80% of the time by February?
Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...
