Monitoring Splunk

eval - Error in 'eval' command: The expression is malformed. Expected ).

tnguyen125
New Member

index=abc123 | eval app=case(application==Application_1,"app_id_1",application==Application_2,"app_id_2") | stats count by app

This search returns: Error in 'eval' command: The expression is malformed. Expected ).
Can you let me know what's wrong with my search ? Thank you

Tags (1)
0 Karma
1 Solution

javiergn
Super Champion

Hi,

Your expression looks a bit weird in the question because you didn't use the code button and some symbols weren't escaped.
In any case, you could try with something like:

index=abc123 
| eval app=case (
    application=="Application_1", "app_id_1",
    application=="Application_2", "app_id_2",
    1==1, "other"
)
| stats count by app

Which includes a matching for the two types of application names you want to match, but also a third option which is always true in case none of the previous matches work.

Hope that helps
J

View solution in original post

tnguyen125
New Member

Thank you

0 Karma

javiergn
Super Champion

Hi,

Your expression looks a bit weird in the question because you didn't use the code button and some symbols weren't escaped.
In any case, you could try with something like:

index=abc123 
| eval app=case (
    application=="Application_1", "app_id_1",
    application=="Application_2", "app_id_2",
    1==1, "other"
)
| stats count by app

Which includes a matching for the two types of application names you want to match, but also a third option which is always true in case none of the previous matches work.

Hope that helps
J

javiergn
Super Champion

Hi @tnguyen125, did the answer above help? If so, please don't forget to mark it as answered. If not please provide some feedback.

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...