Splunk Search

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

sudeshna_dash
New Member

I am trying to extract a particular value from subsearch and use it to append in all the events of a particular source file.

My query is as follows:

source="c:\\splunk monitors\\log(2).txt" | eval Servtag = \"[search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^\[\n]*\[(?P[^\]]+)" | eval tag = SvcTag | return $tag]\"

Here I am using

"[search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^\[\n]*\[(?P[^\]]+)" | eval tag = SvcTag | return $tag]" subsearch to return a value "5Q4RZH2" and assign it to **Servtag** 

But it is throwing an error. I dont know how to return a string from subsearch and use it to assign a variable Servtag

0 Karma

mayurr98
Super Champion

Try this

source="c:\\splunk monitors\\log(2).txt"  | eval ServiceTag = case([search source="c:\\splunk monitors\\log(2).txt" | head 1 |  rex field=_raw "^[^\[\n]*\[(?P<SvcTag>[^\]]+)" | eval tag = SvcTag | return 10000 tag ],tag)

let me know if it helps!

0 Karma

sudeshna_dash
New Member

Thanks @mayrr98 but this is not working. I want to get the data from the "tag variable" and store it
search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^\[\n]*\[(?P<SvcTag>[^\]]+)" | eval tag = SvcTag | return $tag

0 Karma

mayurr98
Super Champion
source="c:\\splunk monitors\\log(2).txt" | eval Servtag = case([search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^[\n]*[(?P[^]]+)" | eval tag = SvcTag | return 10000 tag],tag)

Also, check your rex expression. is it working fine? because I can not see field name given to extracted field in your rex expression.
put your query in code sample format.
let me know if it helps!

0 Karma

niketn
Legend

@sudeshna_dash, please post the SPL by pressing the code button (one with 101010) here on Splunk Answers so that special characters do not escape. You can also give four spaces before your SPL query and add one line gap with the previous text description.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sudeshna_dash
New Member
source="c:\\splunk monitors\\log(2).txt"  | eval ServiceTag = [search source="c:\\splunk monitors\\log(2).txt" | head 1 |  rex field=_raw "^[^\[\n]*\[(?P<SvcTag>[^\]]+)" | eval tag = SvcTag | return $tag ]
0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...