help on where command which is malformed

[jip31]

hi

I have an issue in the where command below (The expression is malformed)
What is the problem please??

| eval PROCESS=case(process_name like "mfev%" OR process_name like "mcdatrep" OR process_name=="mcshield" OR process_name=="amupdate" OR process_name=="McScript_InUse" OR process_name=="macompatsvc" OR process_name=="FrameworkService" OR process_name=="McScanCheck", "TITI", process_name like "Wmi%", "WMI", process_name=="conhost", "CMD Windows console", process_name=="csrss" OR process_name=="System" OR process_name=="TiWorker" OR process_name=="msfeedssync" OR process_name=="dwm" OR process_name=="perf-test-9c" OR process_name like "SearchProtocolHost%" OR process_name like "RuntimeBroker%" OR process_name like "LogonUI%", "TUTU") 
| stats dc(eval(if(process_cpu_used_percent > 50,host,NULL))) as Total by PROCESS 
| where PROCESS==("TITI","TUTU")`

[tdoSplunk · Accepted solution]

Hi jip31,

why are you using a single quote at the end of this line? | where PROCESS==("TITI","TUTU")

because of the single quote a macro is expected.
remove the quote and/or replace with something like this

| where like(PROCESS,"TITI") OR like(PROCESS,"TUTU")

best regards