eval with malformed in my nested if. Expected (.

[peiyee422]

Hi,

Need help urgently. I am running Splunk command in batch file but I keep on getting
FATAL: Error in 'eval' command: The expression is malformed. Expected ).

This is my command:
eval 1Status=if(Test_Result=""Passed"","No Issue",if(PreviousResult>0,"Known","New"))
Can anyone tell me what is wrong with this command?

Thank you so much!

[niketn]

@peiyee422 Does your Test_Result value actually contain double quote in it?

If Not try the following:

| eval 1Status=if(Test_Result="Passed","No Issue",if(PreviousResult>0,"Known","New"))

If Not try the following which escapes double quotes in eval using \":

| eval 1Status=if(Test_Result="\"Passed\"","No Issue",if(PreviousResult>0,"Known","New"))

[peiyee422]

Hi, it is not working in these ways.
This is because I am running them in a batch file, it needs a escape brackets.

BUT I replaced the if statement with case:
eval Test_Status=case(Test_Result=""Passed"",""No Issue"",PreviousResult>0,""Known Issue"", PreviousResult=0,""New"")

[niketn]

What do you mean by running them in a batch file. Also are you still getting error? What do you mean by it is not working?

[peiyee422]

I run the query in a batch file, still getting the same error.
Anyways, issue solved by using CASE.
Thank you so much for the comments!! 🙂 🙂

[niketn]

Good to know. Please post your solution and accept the same as answer to mark this question as answered!

Do up vote the comment/s that helped!