Splunk Search

How to edit my eval statement to resolve "Error in 'eval' command: Regex: nothing to repeat"?

marina_rovira
Contributor

Hello all,

I'm trying to filter some event by their Summary. I just want to distinguish when they have the word Maintenance and catalogue the rest as "other".

My eval statement is this:

eval camp = if(match(Summary,"*Planned*"),"mainten","other") | top limit=50 Summary,camp

I'm trying with Planned because if I put "maintenance", I get this error:

Error in 'eval' command: Regex: nothing to repeat 

but there can be planned and emergency maintenances and I want all of them as the same group.

Any idea why and how can I resolve this error?

Thank you in advance.

0 Karma
1 Solution

renjith_nair
Legend

You don't need * in your match. Match matches the string with wild cards.

Try using

 eval camp = if(match(Summary,"Planned"),"mainten","other") | top limit=50 Summary,camp
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

You don't need * in your match. Match matches the string with wild cards.

Try using

 eval camp = if(match(Summary,"Planned"),"mainten","other") | top limit=50 Summary,camp
---
What goes around comes around. If it helps, hit it with Karma 🙂

marina_rovira
Contributor

Thank you! 🙂 It works now

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...