Splunk Search

Error in 'eval' command: The expression is malformed. Expected ).

cmarrott
Explorer

 

 

<query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | eval status=(status, "4%"),"4xx" | stats count by status</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>

 

 

I am trying to make a pie chart that shows all the 4xx errors, and then breaks them out by error - so x% was 401, y% was 402, etc.

But i am getting Error in 'eval' command: The expression is malformed. Expected ). when i run this on the dashboard.

Labels (3)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@cmarrott 

Can you please try this?

<query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | where like(status,"4%") | stats count by status</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

What is this

eval status=(status, "4%"),"4xx"

trying to do?

Also, I am not sure you need to escape the backslash in the rex as you are probably trying to escape the d and I expect you don't really need a field that always has the text "HttpStatus" in

rex field=message "HttpStatus: (?&lt;status&gt;\d+)"

 

0 Karma

cmarrott
Explorer

 



@ITWhisperer wrote:

What is this

 

eval status=(status, "4%"),"4xx"

 

trying to do?

Also, I am not sure you need to escape the backslash in the rex as you are probably trying to escape the d and I expect you don't really need a field that always has the text "HttpStatus" in

 

rex field=message "HttpStatus: (?&lt;status&gt;\d+)"

 

 


I'm not sure I understand.

To clarify what the query is intending to do overall is 

Search for a specific API, return all status codes of a specific type, display them in a piechart by % :

cmarrott_0-1625071432548.png

 

This is using the solution provided by @kamlesh_vaghela 

 



0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@cmarrott 

Can you please try this?

<query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | where like(status,"4%") | stats count by status</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

cmarrott
Explorer

cmarrott_0-1625070955852.png

Confirmed this worked! Thank you!

 

0 Karma

cmarrott
Explorer
 <query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | eval ActResult=case(status=400, "400", status=401, "401", status=402, "402", status=403, "403", status=404, "404") | stats count by ActResult | eval ActResult = count+" : "+ActResult</query>

Is it better to do it like this?

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...