Problem of mismatched quotes and/or parenthesis says splunk but not my editor...

[mehdiazmi]

Hello everyone!

when I'am performing that search :

| inputlookup table-vuln-machin.csv | chart eval( count ( eval [ search index=qualys_truc_hosts | dedup HOST.IP | stats dc(HOST.IP)] - count( eval [| inputlookup table-vuln-machin.csv | dedup IP | stats dc(IP)] ) ) )

I am getting this answer :

Error in 'SearchProcessor': Mismatched quotes and/or parenthesis.

After I have copied and pasted it in my editor, I see no mismatching quote or parenthesis.

All the indexes and inputlookups are working fine on other searches.

Could you explain me why?

Thank you

[somesoni2 · Accepted solution]

Try this

| inputlookup table-vuln-machin.csv | stats dc(IP) s count2 | eval difference=[ search index=qualys_truc_hosts | stats dc(HOST.IP) as search]-count2

[mehdiazmi]

Thank you.
I did it in another way but your solution works too.

Thanks again and have a nice day.

[richgalloway]

I suspect the error message is inaccurate, something I've noticed before. I also can't say I've seen searches within an eval before so I wonder if that is the source of the error. Consider rewriting your search something like this:

index=qualys_truc_hosts | dedup HOST.IP | stats dc(HOST.IP) as hostCount | appendcols [| inputlookup table-vuln-machin.csv | dedup IP | stats dc(IP) as IPcount]  | chart count(eval hostCount-IPcount)

[mehdiazmi]

Thank you for your help.

Unfortunately, it's not working. I'll try another way.

Once again, thank you.

[chimell]

What do you want to do?
It is better to change the way to write request
Just tell the thing that you want to do