Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

[sudeshna_dash]

I am trying to extract a particular value from subsearch and use it to append in all the events of a particular source file.

My query is as follows:

source="c:\\splunk monitors\\log(2).txt" | eval Servtag = \"[search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^\[\n]*\[(?P[^\]]+)" | eval tag = SvcTag | return $tag]\"

Here I am using

"[search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^\[\n]*\[(?P[^\]]+)" | eval tag = SvcTag | return $tag]" subsearch to return a value "5Q4RZH2" and assign it to **Servtag** 

But it is throwing an error. I dont know how to return a string from subsearch and use it to assign a variable Servtag

[mayurr98]

Try this

source="c:\\splunk monitors\\log(2).txt"  | eval ServiceTag = case([search source="c:\\splunk monitors\\log(2).txt" | head 1 |  rex field=_raw "^[^\[\n]*\[(?P<SvcTag>[^\]]+)" | eval tag = SvcTag | return 10000 tag ],tag)

let me know if it helps!

[sudeshna_dash]

Thanks @mayrr98 but this is not working. I want to get the data from the "tag variable" and store it
search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^\[\n]*\[(?P<SvcTag>[^\]]+)" | eval tag = SvcTag | return $tag

[mayurr98]

source="c:\\splunk monitors\\log(2).txt" | eval Servtag = case([search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^[\n]*[(?P[^]]+)" | eval tag = SvcTag | return 10000 tag],tag)

Also, check your rex expression. is it working fine? because I can not see field name given to extracted field in your rex expression.
put your query in code sample format.
let me know if it helps!

[niketn]

@sudeshna_dash, please post the SPL by pressing the code button (one with 101010) here on Splunk Answers so that special characters do not escape. You can also give four spaces before your SPL query and add one line gap with the previous text description.

[sudeshna_dash]

source="c:\\splunk monitors\\log(2).txt"  | eval ServiceTag = [search source="c:\\splunk monitors\\log(2).txt" | head 1 |  rex field=_raw "^[^\[\n]*\[(?P<SvcTag>[^\]]+)" | eval tag = SvcTag | return $tag ]