Splunk Search

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '[|

sharma11031988
Explorer

Hello All,

I am trying to remove events from my Dashboards for a specific time frame using data input from lookup.

I was able to use something from a blog, https://answers.splunk.com/answers/659389/how-to-exclude-multiple-time-ranges-from-multiple.html , and use this code to remove events:(This is the only format with which I can remove my event)

if(([| inputlookup exclusion.csv | convert timeformat="%b/%d/%Y %H:%M:%S" mktime(EndTime) mktime(StartTime) | eval search="_time>=".StartTime." AND _time<=".EndTime | return 500 $search]),"false","true")

However, when I enable acceleration on my Data model, I am getting a syntax error for a condition put in DM like this, while same works fine without acceleration

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '[| inputlookup exclusion.csv | convert timeformat="%b/%d/%Y %H:%M:%S" mktime(EndTime) mktime(StartTime) | eval search="_time>=".StartTime." AND _time<=".EndTime | return 500 $search] ,"false","true")'

Can anyone help me figure out what am I doing wrong?

Tags (2)
0 Karma