Why am I getting an eval command error "The arguments to the match function are invalid"?

[Taner]

I would like to create a new panel in my Dashboard and I am using the following search string:

index=$index$ eventId=xy source="zz-json.log" (X-TRACE-ID="PV3*") OR (X-TRACE-ID="IPL*")| dedup X-TRACE-ID |
eval event=case(
match(X-TRACE-ID,"PV3"),"Option1",
match(X-TRACE-ID,"IPL"),"Option2") | chart count by event

Why do I get the error message: Error in "eval" command: The arguments to the „match“ function are invalid.

Could you please help me 😞 ?

[somesoni2 · Accepted solution]

You should enclose field names with special characters within single quotes in eval and where clause. Like this

index=$index$ eventId=xy source="zz-json.log" (X-TRACE-ID="PV3*") OR (X-TRACE-ID="IPL*")| dedup X-TRACE-ID | 
eval event=case( 
match('X-TRACE-ID',"PV3"),"Option1", 
match('X-TRACE-ID',"IPL"),"Option2") | chart count by event

[Taner]

It is working. Thank you very much 🙂

[s2_splunk]

The hyphens in your field names cause Splunk to evaluate the field as the expression X minus TRACE minus ID. Try adding | rename X-TRACE-ID as xtraceid after your dedup and use xtraceid in your match expressions and it should work as expected.

[s2_splunk]

response overlap with sbbadri, sorry for the dupe

[sbbadri]

try below, i think - in XTRACEID created a issue.

index=$index$ eventId=xy source="zz-json.log" (X-TRACE-ID="PV3*") OR (X-TRACE-ID="IPL*")| dedup X-TRACE-ID | rename X-TRACE-ID as XTRACEID | eval event=case(
match(XTRACEID ,"PV3"),"Option1",
match(XTRACEID ,"IPL"),"Option2") | chart count by event