Why am I getting "Error in 'eval' command: The expression is malformed. Expected )."

[sunil_bansal]

Instance_ID is one extracted field in code *. If there is a value in the $ID$ field, then result should list only for that value, else as default, it should display results for all values (for all values, I am trying * to tmp)

Code *|eval tmp="$ID$" | eval tmp=if(isnull(tmp),"*",tmp |search Instance_ID =  tmp

[masonmorales · Accepted solution]

The error is telling you that you are missing an end parenthesis in your eval command. So, just add one in, like this:

 Code *|eval tmp="$ID$" | eval tmp=if(isnull(tmp),"*",tmp) |search Instance_ID =  tmp

[javiergn]

There seems to be a typo in your code and you need to use "where" instead of "search" when comparing fields:

Code |eval tmp="$ID$" | eval tmp=if(isnull(tmp),"",tmp) | where Instance_ID = tmp

You can also use the match operator. See this post