Splunk Search
Highlighted

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

New Member

I am trying to extract a particular value from subsearch and use it to append in all the events of a particular source file.

My query is as follows:

source="c:\\splunk monitors\\log(2).txt" | eval Servtag = \"[search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^\[\n]*\[(?P[^\]]+)" | eval tag = SvcTag | return $tag]\"

Here I am using

"[search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^\[\n]*\[(?P[^\]]+)" | eval tag = SvcTag | return $tag]" subsearch to return a value "5Q4RZH2" and assign it to **Servtag** 

But it is throwing an error. I dont know how to return a string from subsearch and use it to assign a variable Servtag

0 Karma
Highlighted

Re: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

Legend

@sudeshna_dash, please post the SPL by pressing the code button (one with 101010) here on Splunk Answers so that special characters do not escape. You can also give four spaces before your SPL query and add one line gap with the previous text description.




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

New Member
source="c:\\splunk monitors\\log(2).txt"  | eval ServiceTag = [search source="c:\\splunk monitors\\log(2).txt" | head 1 |  rex field=_raw "^[^\[\n]*\[(?P<SvcTag>[^\]]+)" | eval tag = SvcTag | return $tag ]
0 Karma
Highlighted

Re: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

SplunkTrust
SplunkTrust
source="c:\\splunk monitors\\log(2).txt" | eval Servtag = case([search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^[\n]*[(?P[^]]+)" | eval tag = SvcTag | return 10000 tag],tag)

Also, check your rex expression. is it working fine? because I can not see field name given to extracted field in your rex expression.
put your query in code sample format.
let me know if it helps!

0 Karma
Highlighted

Re: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

SplunkTrust
SplunkTrust

Try this

source="c:\\splunk monitors\\log(2).txt"  | eval ServiceTag = case([search source="c:\\splunk monitors\\log(2).txt" | head 1 |  rex field=_raw "^[^\[\n]*\[(?P<SvcTag>[^\]]+)" | eval tag = SvcTag | return 10000 tag ],tag)

let me know if it helps!

0 Karma
Highlighted

Re: Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\" 5Q4RZH2 \"'.

New Member

Thanks @mayrr98 but this is not working. I want to get the data from the "tag variable" and store it
search source="c:\\splunk monitors\\log(2).txt" | head 1 | rex field=_raw "^[^\[\n]*\[(?P<SvcTag>[^\]]+)" | eval tag = SvcTag | return $tag

0 Karma