Splunk Search

case - expression is malformed

jtitus3
Explorer

What am I doing wrong?
* Account_Name=smithjt OR Account_Name=jonestt*
|eval X1=case (Account_Name=="smithjt", "John T Smith", Account_Name=="jonestt", "Tom T Jones")
|table Account_Name, X1

I get --- Error in 'eval' command: The expression is malformed. An unexpected character is reached at "Tom T Jones"

I have tried replacing == with ==, putting in " marks and taking them out. What is the unexpected character?

Tags (2)
0 Karma

abhijeet01
Path Finder

The above answers would be correct but you can try this one also.

index="index_name" Account_Name=smithjt OR Account_Name=jonestt
|eval X1=case (like(Account_Name,"%smithjt%"),"John T Smith", like(Account_Name,"jonestt"), "Tom T Jones")
|table Account_Name, X1

0 Karma

jtitus3
Explorer

I think the major problem was that there were two Account_Names but if there is only one Account_Name the search still works well. Spacing seemed to be important and quotes are required.
* Account_Name=smithja OR Account_Name=jonesst* OR Account_Name=davisgs
|eval name1=mvindex(Account_Name,0)
|eval name2=mvindex(Account_Name,1)
|eval FN1=case(name1==”smitha”, ”John A Smith”,
name1==”jonesst”, ”Steve T Jones”,
name1==”jonesst-admin”, ”Steve T Jones”,
name1==”davisgs”, “Gregg S Davis”)
|eval FN2=case(name2==”smitha”, ”John A Smith”,
Name2==”jonesst”, ”Steve T Jones”,
Name2==”jonesst-admin”, ”Steve T Jones”,
Name2==”davisgs”, “Gregg S Davis”)
|table name1, FN1, name2, FN2

0 Karma

somesoni2
Revered Legend

Try retyping the query in search bar (OR in notepad and then copy the query).

0 Karma

clara-fication
Super Champion

there shouldn't be anything wrong.

|makeresults|eval Account_Name="jonestt"|eval X1=case (Account_Name="smithjt", "John T Smith", Account_Name="jonestt", "Tom T Jones")

I did this with both== and = and it worked just fine. what version are you on?

Solution Clara-fied!
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Reuse: Word-play

This puzzle series (first published here) is based on analysing words.Some of the statements in your puzzle ...

Tuning Edge Processor in Hybrid Mode: What Limits Each Data Path

When you run Edge Processor in hybrid mode, alongside a Splunk heavy forwarder on the same host, two questions ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...