Splunk Search

How to edit my eval statement to resolve "Error in 'eval' command: Regex: nothing to repeat"?

marina_rovira
Contributor

Hello all,

I'm trying to filter some event by their Summary. I just want to distinguish when they have the word Maintenance and catalogue the rest as "other".

My eval statement is this:

eval camp = if(match(Summary,"*Planned*"),"mainten","other") | top limit=50 Summary,camp

I'm trying with Planned because if I put "maintenance", I get this error:

Error in 'eval' command: Regex: nothing to repeat 

but there can be planned and emergency maintenances and I want all of them as the same group.

Any idea why and how can I resolve this error?

Thank you in advance.

0 Karma
1 Solution

renjith_nair
Legend

You don't need * in your match. Match matches the string with wild cards.

Try using

 eval camp = if(match(Summary,"Planned"),"mainten","other") | top limit=50 Summary,camp
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

You don't need * in your match. Match matches the string with wild cards.

Try using

 eval camp = if(match(Summary,"Planned"),"mainten","other") | top limit=50 Summary,camp
---
What goes around comes around. If it helps, hit it with Karma 🙂

marina_rovira
Contributor

Thank you! 🙂 It works now

0 Karma
Get Updates on the Splunk Community!

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and ...

Full-Stack Security in Financial Services: AppDynamics, Cisco Secure Application, and Splunk ES Protecting a ...

It's Customer Success Time at .conf25

Hello Splunkers,   Ready for .conf25? The customer success and experience team is and can’t wait to see you ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...