Why is my search producing "Error in 'eval' command: The expression is malformed"?

[douglas_garland]

I created a macro and used the search string below. After submitting the search, I received the following error message, Error in 'eval' command: The expression is malformed. Would appreciate help correcting the error.

index=akamai* | eval ipv6_valid = if(match(ipv6, ipv6 regex macro))

[bshuler_splunk]

macros should be wrapped in back ticks

index=akamai* | eval ipv6_valid = if(match(ipv6, `ipv6 regex macro`),"yes","no")

[douglas_garland]

The back ticks don't seem to work and generate the initial error message I reported which was, "Error in 'eval' command: The expression is malformed".

However, double quotes provide results which include a mix of ipv4 and ipv6 addresses. I am trying just to pull out the IPv6 addresses.

[somesoni2 · Accepted solution]

I'm hoping you're using a valid regex, in double quotes, in place of 'ipv6 regex macro', then try this

index=akamai* | eval ipv6_valid = if(match(ipv6, ipv6 regex macro),"yes","no")

[douglas_garland]

I am using a valid regex. Thank you, your answer worked.

However, I am also receiving IPv4 addresses. I used the below IPv6 regex taken from here: https://answers.splunk.com/answers/173708/how-to-write-a-search-to-find-if-a-field-contains.html.

"^(([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:)|fe80:(:[0-9a-fA-F]{0,4}){0,4}%[0-9a-zA-Z]{1,}|::(ffff(:0{1,4}){0,1}:){0,1}((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9])|([0-9a-fA-F]{1,4}:){1,4}:((25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]).){3,3}(25[0-5]|(2[0-4]|1{0,1}[0-9]){0,1}[0-9]))$"), "valid", "invalid")

[aaraneta_splunk]

Hi douglas - Did the answer provided by somesoni2 help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

[somesoni2]

If you've created a macro for ipv4 as well, as mentioned by Martin in the post you mentioned, something like this should work. (check field name)

index=akamai* | eval ipv6_valid = if(match(ipv6, ipv6 regex macro) OR match(ipv6, ipv4 regex macro),"yes","no")