Monitoring Splunk

eval - Error in 'eval' command: The expression is malformed. Expected ).

tnguyen125
New Member

index=abc123 | eval app=case(application==Application_1,"app_id_1",application==Application_2,"app_id_2") | stats count by app

This search returns: Error in 'eval' command: The expression is malformed. Expected ).
Can you let me know what's wrong with my search ? Thank you

Tags (1)
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Hi,

Your expression looks a bit weird in the question because you didn't use the code button and some symbols weren't escaped.
In any case, you could try with something like:

index=abc123 
| eval app=case (
    application=="Application_1", "app_id_1",
    application=="Application_2", "app_id_2",
    1==1, "other"
)
| stats count by app

Which includes a matching for the two types of application names you want to match, but also a third option which is always true in case none of the previous matches work.

Hope that helps
J

View solution in original post

tnguyen125
New Member

Thank you

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

Your expression looks a bit weird in the question because you didn't use the code button and some symbols weren't escaped.
In any case, you could try with something like:

index=abc123 
| eval app=case (
    application=="Application_1", "app_id_1",
    application=="Application_2", "app_id_2",
    1==1, "other"
)
| stats count by app

Which includes a matching for the two types of application names you want to match, but also a third option which is always true in case none of the previous matches work.

Hope that helps
J

javiergn
SplunkTrust
SplunkTrust

Hi @tnguyen125, did the answer above help? If so, please don't forget to mark it as answered. If not please provide some feedback.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...