Splunk Search

Error in 'where' command: The expression is malformed. Expected ).

sumarri
Path Finder

So I am creating a dashboard and I keep getting this error: 

Error in 'where' command: The expression is malformed. Expected ).

This is what I have:

| loadjob savedsearch="name:search:cust_info"
| where AccountType IN ($AccountType$)

 

I created a multiselect filter on AccountType and I want the SPL to query on those selected. 

What could I be missing or another way to achieve this query to filter on AccountType?

Labels (1)
0 Karma
1 Solution

sumarri
Path Finder

I have soled the issue. 

 

I needed to add quotes to the AccountType:

| where AccountType IN ("$AccountType$")

 

I also needed to change the delimiter:

<delimiter>,</delimiter>

 

This solved the problem for me! Thank you!

View solution in original post

sumarri
Path Finder

I have soled the issue. 

 

I needed to add quotes to the AccountType:

| where AccountType IN ("$AccountType$")

 

I also needed to change the delimiter:

<delimiter>,</delimiter>

 

This solved the problem for me! Thank you!

richgalloway
SplunkTrust
SplunkTrust

The IN operator only works in the search command.  In where you must use the in function.

| loadjob savedsearch="name:search:cust_info"
| where in(AccountType,$AccountType$)

 

---
If this reply helps you, Karma would be appreciated.

sumarri
Path Finder

Hey! I still get the same error. But thank you for trying! Let me know if something else clicks. Thank you.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What does the $AccountType$ token expand to?

---
If this reply helps you, Karma would be appreciated.

sumarri
Path Finder

So, it is expected to get the AccountTypes selected from the user on the dashboard from the multiselect filter. 

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...