Splunk Search

case - expression is malformed

jtitus3
Explorer

What am I doing wrong?
* Account_Name=smithjt OR Account_Name=jonestt*
|eval X1=case (Account_Name=="smithjt", "John T Smith", Account_Name=="jonestt", "Tom T Jones")
|table Account_Name, X1

I get --- Error in 'eval' command: The expression is malformed. An unexpected character is reached at "Tom T Jones"

I have tried replacing == with ==, putting in " marks and taking them out. What is the unexpected character?

Tags (2)
0 Karma

abhijeet01
Path Finder

The above answers would be correct but you can try this one also.

index="index_name" Account_Name=smithjt OR Account_Name=jonestt
|eval X1=case (like(Account_Name,"%smithjt%"),"John T Smith", like(Account_Name,"jonestt"), "Tom T Jones")
|table Account_Name, X1

0 Karma

jtitus3
Explorer

I think the major problem was that there were two Account_Names but if there is only one Account_Name the search still works well. Spacing seemed to be important and quotes are required.
* Account_Name=smithja OR Account_Name=jonesst* OR Account_Name=davisgs
|eval name1=mvindex(Account_Name,0)
|eval name2=mvindex(Account_Name,1)
|eval FN1=case(name1==”smitha”, ”John A Smith”,
name1==”jonesst”, ”Steve T Jones”,
name1==”jonesst-admin”, ”Steve T Jones”,
name1==”davisgs”, “Gregg S Davis”)
|eval FN2=case(name2==”smitha”, ”John A Smith”,
Name2==”jonesst”, ”Steve T Jones”,
Name2==”jonesst-admin”, ”Steve T Jones”,
Name2==”davisgs”, “Gregg S Davis”)
|table name1, FN1, name2, FN2

0 Karma

somesoni2
Revered Legend

Try retyping the query in search bar (OR in notepad and then copy the query).

0 Karma

clara-fication
Super Champion

there shouldn't be anything wrong.

|makeresults|eval Account_Name="jonestt"|eval X1=case (Account_Name="smithjt", "John T Smith", Account_Name="jonestt", "Tom T Jones")

I did this with both== and = and it worked just fine. what version are you on?

Solution Clara-fied!
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How Splunk AI Assistant Is Transforming Investigations: Insights from .conf26

At .conf26 in Denver, I spent much of my time in conversation with Splunk customers about Splunk AI Assistant. ...

Make Your Machine Data AI-Ready in Splunk

Every team is getting ready for AI agents.   Thursday, November 12, 2026  |  11AM  PST / 2PM EST   ...

Splunk Asynchronous Forwarding Explained

Splunk asynchronous forwarding is often misunderstood as simply setting autoLBVolume. That is not quite right. ...