Splunk Search

Error in 'where' command: The expression is malformed. Expected ).

sumarri
Path Finder

So I am creating a dashboard and I keep getting this error: 

Error in 'where' command: The expression is malformed. Expected ).

This is what I have:

| loadjob savedsearch="name:search:cust_info"
| where AccountType IN ($AccountType$)

 

I created a multiselect filter on AccountType and I want the SPL to query on those selected. 

What could I be missing or another way to achieve this query to filter on AccountType?

0 Karma
1 Solution

sumarri
Path Finder

I have soled the issue. 

 

I needed to add quotes to the AccountType:

| where AccountType IN ("$AccountType$")

 

I also needed to change the delimiter:

<delimiter>,</delimiter>

 

This solved the problem for me! Thank you!

View solution in original post

sumarri
Path Finder

I have soled the issue. 

 

I needed to add quotes to the AccountType:

| where AccountType IN ("$AccountType$")

 

I also needed to change the delimiter:

<delimiter>,</delimiter>

 

This solved the problem for me! Thank you!

richgalloway
SplunkTrust
SplunkTrust

The IN operator only works in the search command.  In where you must use the in function.

| loadjob savedsearch="name:search:cust_info"
| where in(AccountType,$AccountType$)

 

---
If this reply helps you, Karma would be appreciated.

sumarri
Path Finder

Hey! I still get the same error. But thank you for trying! Let me know if something else clicks. Thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What does the $AccountType$ token expand to?

---
If this reply helps you, Karma would be appreciated.

sumarri
Path Finder

So, it is expected to get the AccountTypes selected from the user on the dashboard from the multiselect filter. 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...