Splunk Search

Why i am getting Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\"1\", \"icon-check\", \"icon-alert\")'.

vasanthi77
Explorer

Hi all ,

I am trying to configure alert for data replication in cluster manger. Using below query , getting "Error in 'eval' command: The expression is malformed. An unexpected character is reached at '\"1\", \"icon-check\", \"icon-alert\")'. "

| rest splunk_server_group=dmc_group_cluster_master splunk_server_group=\"$group$\" /services/cluster/master/generation/master

| fields pending_last_reason, search_factor_met, replication_factor_met

| eval all_data_searchable_icon = if(isnull(pending_last_reason) or pending_last_reason== \"1\", \"icon-check\", \"icon-alert\")

| eval all_data_searchable = if (isnull(pending_last_reason) or pending_last_reason==\"\", \"All Data is Searchable\", \"Some Data is Not Searchable\")

| eval search_factor_met_icon = if(search_factor_met == 1 or search_factor_met == \"1\", \"icon-check\", \"icon-alert\")

| eval search_factor_met = if (search_factor_met == 1 or search_factor_met == \"1\", \"Search Factor is Met\", \"Search Factor is Not Met\")

| eval replication_factor_met_icon = if(replication_factor_met == 1 or replication_factor_met == \"1\", \"icon-check\", \"icon-alert\")

| eval replication_factor_met = if (replication_factor_met == 1 or replication_factor_met == \"1\", \"Replication Factor is Met\", \"Replication Factor is Not Met\")

can some one please help me here

Thanks in advance

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

| rest splunk_server_group=dmc_group_cluster_master splunk_server_group=* /services/cluster/master/generation/master
| fields pending_last_reason, search_factor_met, replication_factor_met
| eval all_data_searchable_icon = if(isnull(pending_last_reason) or pending_last_reason== "1", "icon-check", "icon-alert") 
| eval all_data_searchable = if (isnull(pending_last_reason) or pending_last_reason=="", "All Data is Searchable", "Some Data is Not Searchable") 
| eval search_factor_met_icon = if(search_factor_met == 1 or search_factor_met == "1", "icon-check", "icon-alert") 
| eval search_factor_met = if (search_factor_met == 1 or search_factor_met == "1", "Search Factor is Met", "Search Factor is Not Met") 
| eval replication_factor_met_icon = if(replication_factor_met == 1 or replication_factor_met == "1", "icon-check", "icon-alert") 
| eval replication_factor_met = if (replication_factor_met == 1 or replication_factor_met == "1", "Replication Factor is Met", "Replication Factor is Not Met")

When extracting a search from a dashboard panel, EITHER use the Magnifying Glass icon to Open in search OR edit the panel in GUI mode (NOT XML) and then click the Magnifying Glass icon to Edit search and copy it from there. If you copy it from XML edit, you will have these kinds of problems.

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

| rest splunk_server_group=dmc_group_cluster_master splunk_server_group=* /services/cluster/master/generation/master
| fields pending_last_reason, search_factor_met, replication_factor_met
| eval all_data_searchable_icon = if(isnull(pending_last_reason) or pending_last_reason== "1", "icon-check", "icon-alert") 
| eval all_data_searchable = if (isnull(pending_last_reason) or pending_last_reason=="", "All Data is Searchable", "Some Data is Not Searchable") 
| eval search_factor_met_icon = if(search_factor_met == 1 or search_factor_met == "1", "icon-check", "icon-alert") 
| eval search_factor_met = if (search_factor_met == 1 or search_factor_met == "1", "Search Factor is Met", "Search Factor is Not Met") 
| eval replication_factor_met_icon = if(replication_factor_met == 1 or replication_factor_met == "1", "icon-check", "icon-alert") 
| eval replication_factor_met = if (replication_factor_met == 1 or replication_factor_met == "1", "Replication Factor is Met", "Replication Factor is Not Met")

When extracting a search from a dashboard panel, EITHER use the Magnifying Glass icon to Open in search OR edit the panel in GUI mode (NOT XML) and then click the Magnifying Glass icon to Edit search and copy it from there. If you copy it from XML edit, you will have these kinds of problems.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...