Splunk Search

edit fields with eval expressions

jerm1020rq
Explorer

I am receiving an error of "The expression is malformed. Expected IN." any time we search utilizing the web data model. When i remove this eval expression 'if(act="File quarantined","blocked",action)' the search works fine so I am assuming that this is the problem child. does anyone see anything inherently wrong with this expression?

Labels (1)
Tags (2)
0 Karma
1 Solution

nickhills
Ultra Champion

Where are you seeing this? Inside the web datamodel?

In which case, the action field should look like this (see attached)

If you really want to include that additional logic into the datamodel (which I am reluctant to advise) you will need to change it to a "case" statement, you cant just layer up additional "if()"s.

 

case(action="File quarantined","blocked", isnull(action) OR action="","unknown", 1=1, action)

 

If my comment helps, please give it a thumbs up!

View solution in original post

Tags (1)

nickhills
Ultra Champion

try changing it to 

 

if(action="File quarantined","blocked",action)

 

That looks to me like the intent is to re-write the action to be "blocked" for a quarantine message, otherwise leave action as it was

if (action = quarantine, re-write it as action="blocked", otherwise set action=action( i.e whatever it already was) )

 

 

If my comment helps, please give it a thumbs up!
0 Karma

jerm1020rq
Explorer

I appreciate the reply, unfortunately it did not work. There are 2 eval expressions seen as below. Does there need to be something in between? Thank you !

if(isnull(action) OR action="","unknown",action)
if(act="File quarantined","blocked",action)

0 Karma

nickhills
Ultra Champion

Where are you seeing this? Inside the web datamodel?

In which case, the action field should look like this (see attached)

If you really want to include that additional logic into the datamodel (which I am reluctant to advise) you will need to change it to a "case" statement, you cant just layer up additional "if()"s.

 

case(action="File quarantined","blocked", isnull(action) OR action="","unknown", 1=1, action)

 

If my comment helps, please give it a thumbs up!
Tags (1)
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...