Splunk Search

case - expression is malformed


What am I doing wrong?
* Account_Name=smithjt OR Account_Name=jonestt*
|eval X1=case (Account_Name=="smithjt", "John T Smith", Account_Name=="jonestt", "Tom T Jones")
|table Account_Name, X1

I get --- Error in 'eval' command: The expression is malformed. An unexpected character is reached at "Tom T Jones"

I have tried replacing == with ==, putting in " marks and taking them out. What is the unexpected character?

Tags (2)
0 Karma

Path Finder

The above answers would be correct but you can try this one also.

index="index_name" Account_Name=smithjt OR Account_Name=jonestt
|eval X1=case (like(Account_Name,"%smithjt%"),"John T Smith", like(Account_Name,"jonestt"), "Tom T Jones")
|table Account_Name, X1

0 Karma


I think the major problem was that there were two Account_Names but if there is only one Account_Name the search still works well. Spacing seemed to be important and quotes are required.
* Account_Name=smithja OR Account_Name=jonesst* OR Account_Name=davisgs
|eval name1=mvindex(Account_Name,0)
|eval name2=mvindex(Account_Name,1)
|eval FN1=case(name1==”smitha”, ”John A Smith”,
name1==”jonesst”, ”Steve T Jones”,
name1==”jonesst-admin”, ”Steve T Jones”,
name1==”davisgs”, “Gregg S Davis”)
|eval FN2=case(name2==”smitha”, ”John A Smith”,
Name2==”jonesst”, ”Steve T Jones”,
Name2==”jonesst-admin”, ”Steve T Jones”,
Name2==”davisgs”, “Gregg S Davis”)
|table name1, FN1, name2, FN2

0 Karma

Revered Legend

Try retyping the query in search bar (OR in notepad and then copy the query).

0 Karma

Super Champion

there shouldn't be anything wrong.

|makeresults|eval Account_Name="jonestt"|eval X1=case (Account_Name="smithjt", "John T Smith", Account_Name="jonestt", "Tom T Jones")

I did this with both== and = and it worked just fine. what version are you on?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!