Error in 'eval' command: unexpected character at 86400

[inventsekar]

Hi All, On the internal logs i see this eval command error - 
ERROR EvalCommand - Error in 'eval' command: The expression is malformed. An unexpected character is reached at '*)/86400)'.

but it does not provide more details like which search query / search report / alert caused this error msg. 

searched about this, but no luck. could someone provide some suggestions please. thanks..

[inventsekar]

Hi @richgalloway / Hi All.. the above rest query returns around 25 searches, i ran all of them, all are running fine.. no errors they give(on the gui, as well as on job inspector),..

1) on the internal logs, i see this error around 12 times per hour, (6 times at the hour, 6 times at the 30min).. so, just after it appears on the internal log, i login to the search head linux box, on the dispatch directory,

when i search for the search logs for this error, the correct search query which caused this log into the internal logs not showing up..

find ./ -type f -exec grep -H '/86400)' {} \;

find ./ -name search.log -exec grep -H '/86400)' {} \;

2. apart from search queries, is there anything else which might cause this errors in the internal logs?! (any field extractions, ..etc)

[richgalloway]

Yes, that's one of Splunk's many crappy error messages.

If you have access to the CLI, search the savedsearches.conf files for that reported string.

find /opt/splunk/etc/apps -name savedsearches.conf -exec grep "\*)\/86400)" {} \;

If you don't have CLI access then try this SPL query

| rest /services/saved/searches splunk_server=local
| search search=* 
| where match(search, "\*\)\/86400\)")

[gauravu_14]

After running the SPL query, I am getting the below error:
"Error in 'where' command: Regex: unmatched closing parenthesis"

[richgalloway]

That's probably because of improper escaping of the embedded ')' characters.  I've corrected my answer.

[gauravu_14]

Thanks, the SPL did work this time. However, there was no result for the mentioned string and yet I am seeing that error

[richgalloway]

The regex may need to be adjusted.  Try searching just for "86400".