Error in Case Statement

[strive]

Hi,

I have a case statement as mentioned below:

eval MODEVAL = case(mode=="modeA", if (FieldA!=0,FieldA/1024,NULL),mode=="modeB",lookup csv_modes Header1 AS mode_name OUTPUT mode)

I get an error. "Error in 'eval' command: The expression is malformed. Expected )."

If i replace the lookup with NULL part in the above expression, it works fine.
eval MODEVAL = case(mode=="modeA", if (FieldA!=0,FieldA/1024,NULL),mode=="modeB",NULL)

My CSV file is:

Header1,Header2
A,1
B,2

I even changed CSV to:

"Header1","Header2"
"A","1"
"B","2"

I get same error.

Please help.

Thanks
Strive

[Ayn · Accepted solution]

Uh, that's not valid syntax for eval/case at all. You can't use just any command in the statement, it has to be one of those functions supported by eval.

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions