Error in 'eval' command: The expression is malformed. An unexpected character is reached

[sarathipattam]

I was getting when I run the below query, can someone give me the solution pls,

below is my query:

| convert num(actualTimeExtract) as actualTime
|eval buckt=case (
actualTime<1001, “time < 1 sec”,
actualTime>1000 AND actualTime<5001, “1 < time < 5”,
1=1, “time > 15”)
|stats dc(hdr.macaddress) by buckt

[MuS]

Hi sarathipattam,

this is most likely a copy/paste problem, you have “ instead of ". Try the run everywhere search below to see how it works:

| makeresults 
| eval actualTime="1000" 
| eval buckt=case (
    actualTime<1001, "time < 1 sec", 
    actualTime>1000 AND actualTime<5001, "1 < time < 5", 
    1=1, "time > 15")

Hope this helps ...

cheers, MuS

[niketn]

@MuS, it was only yesterday that @xpac and I spoke of the devil “ 😄

https://answers.splunk.com/answers/659050/unicode-characters-in-dashboardssearches.html#answer-65905...