Splunk Search

Error in 'eval' command: The expression is malformed. Expected ).

cmarrott
Explorer

 

 

<query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | eval status=(status, "4%"),"4xx" | stats count by status</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>

 

 

I am trying to make a pie chart that shows all the 4xx errors, and then breaks them out by error - so x% was 401, y% was 402, etc.

But i am getting Error in 'eval' command: The expression is malformed. Expected ). when i run this on the dashboard.

Labels (3)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@cmarrott 

Can you please try this?

<query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | where like(status,"4%") | stats count by status</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

What is this

eval status=(status, "4%"),"4xx"

trying to do?

Also, I am not sure you need to escape the backslash in the rex as you are probably trying to escape the d and I expect you don't really need a field that always has the text "HttpStatus" in

rex field=message "HttpStatus: (?&lt;status&gt;\d+)"

 

0 Karma

cmarrott
Explorer

 



@ITWhisperer wrote:

What is this

 

eval status=(status, "4%"),"4xx"

 

trying to do?

Also, I am not sure you need to escape the backslash in the rex as you are probably trying to escape the d and I expect you don't really need a field that always has the text "HttpStatus" in

 

rex field=message "HttpStatus: (?&lt;status&gt;\d+)"

 

 


I'm not sure I understand.

To clarify what the query is intending to do overall is 

Search for a specific API, return all status codes of a specific type, display them in a piechart by % :

cmarrott_0-1625071432548.png

 

This is using the solution provided by @kamlesh_vaghela 

 



0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@cmarrott 

Can you please try this?

<query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | where like(status,"4%") | stats count by status</query>
          <earliest>$time.earliest$</earliest>
          <latest>$time.latest$</latest>

 

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated. 

cmarrott
Explorer

cmarrott_0-1625070955852.png

Confirmed this worked! Thank you!

 

0 Karma

cmarrott
Explorer
 <query>"$ps_fn$" |rex field=message "(?&lt;Http&gt;HttpStatus): (?&lt;status&gt;\\d+)" | eval ActResult=case(status=400, "400", status=401, "401", status=402, "402", status=403, "403", status=404, "404") | stats count by ActResult | eval ActResult = count+" : "+ActResult</query>

Is it better to do it like this?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...