Splunk Search

Error in 'eval' command: The expression is malformed. Expected ).

cmarrott
Explorer

 

 

<query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | eval status=(status, "4%"),"4xx" | stats count by status</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>

 

 

I am trying to make a pie chart that shows all the 4xx errors, and then breaks them out by error - so x% was 401, y% was 402, etc.

But i am getting Error in 'eval' command: The expression is malformed. Expected ). when i run this on the dashboard.

Labels (3)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@cmarrott 

Can you please try this?

<query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | where like(status,"4%") | stats count by status</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

What is this

eval status=(status, "4%"),"4xx"

trying to do?

Also, I am not sure you need to escape the backslash in the rex as you are probably trying to escape the d and I expect you don't really need a field that always has the text "HttpStatus" in

rex field=message "HttpStatus: (?&lt;status&gt;\d+)"

 

0 Karma

cmarrott
Explorer

 



@ITWhisperer wrote:

What is this

 

eval status=(status, "4%"),"4xx"

 

trying to do?

Also, I am not sure you need to escape the backslash in the rex as you are probably trying to escape the d and I expect you don't really need a field that always has the text "HttpStatus" in

 

rex field=message "HttpStatus: (?&lt;status&gt;\d+)"

 

 


I'm not sure I understand.

To clarify what the query is intending to do overall is 

Search for a specific API, return all status codes of a specific type, display them in a piechart by % :

cmarrott_0-1625071432548.png

 

This is using the solution provided by @kamlesh_vaghela 

 



0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@cmarrott 

Can you please try this?

<query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | where like(status,"4%") | stats count by status</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

cmarrott
Explorer

cmarrott_0-1625070955852.png

Confirmed this worked! Thank you!

 

0 Karma

cmarrott
Explorer
 <query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | eval ActResult=case(status=400, "400", status=401, "401", status=402, "402", status=403, "403", status=404, "404") | stats count by ActResult | eval ActResult = count+" : "+ActResult</query>

Is it better to do it like this?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...