Error in 'eval' command: The expression is malformed. Expected ).

[cmarrott]

<query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | eval status=(status, "4%"),"4xx" | stats count by status</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>

I am trying to make a pie chart that shows all the 4xx errors, and then breaks them out by error - so x% was 401, y% was 402, etc.

But i am getting Error in 'eval' command: The expression is malformed. Expected ). when i run this on the dashboard.

[ITWhisperer]

What is this

eval status=(status, "4%"),"4xx"

trying to do?

Also, I am not sure you need to escape the backslash in the rex as you are probably trying to escape the d and I expect you don't really need a field that always has the text "HttpStatus" in

rex field=message "HttpStatus: (?<status>\d+)"

[cmarrott]

---

---

@ITWhisperer wrote:

What is this

eval status=(status, "4%"),"4xx"

trying to do?

Also, I am not sure you need to escape the backslash in the rex as you are probably trying to escape the d and I expect you don't really need a field that always has the text "HttpStatus" in

rex field=message "HttpStatus: (?<status>\d+)"

---

I'm not sure I understand.

To clarify what the query is intending to do overall is 

Search for a specific API, return all status codes of a specific type, display them in a piechart by % :

This is using the solution provided by @kamlesh_vaghela 

[kamlesh_vaghela · Accepted solution]

@cmarrott 

Can you please try this?

<query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | where like(status,"4%") | stats count by status</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

[cmarrott]

Confirmed this worked! Thank you!

[cmarrott]

 <query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | eval ActResult=case(status=400, "400", status=401, "401", status=402, "402", status=403, "403", status=404, "404") | stats count by ActResult | eval ActResult = count+" : "+ActResult</query>

Is it better to do it like this?