Good afternoon everyone! I'm hoping someone can assist in shedding some light on the following issue. I'm getting the following error : "Error in 'eval' command: The expression is malformed. Expec...
See more...
Good afternoon everyone! I'm hoping someone can assist in shedding some light on the following issue. I'm getting the following error : "Error in 'eval' command: The expression is malformed. Expected )." and I'm uncertain why it isn't functioning. Perhaps there's something I'm missing or I've attempted this eval incorrectly. Any assistance would be greatly appreciated! I've provided the end part of my overall query, the objective here is to determine if there's an increase in the SCORE by 5% each day over a 3 day period, and if there is on any of the days, then flag it. | eval SCORE=(Asales + Bsales / ITEM_COUNT) | stats dc(ITEM) as ITEM_COUNT values(ITEM) as ITEM sum(SALES) as TotalSales sum(SCORE) as SCORE by _time TITLE | where ITEM_COUNT > 1 | eval 0DATE=if(_time >= relative_time(now(), "-1d@-d"),SCORE,0) | eval 1DATE=if(_time >= relative_time(now(), "-2d@-1d"),SCORE,0) | eval 2DATE=if(_time >= relative_time(now(), "-3d@-2d"),SCORE,0) | eval 1TREND=if(1DATE > 0DATE*1.05,1,0) | eval 2TREND=if(2DATE > 0DATE*1.05,1,0) | eval BREAK=if((2DATE+3DATE) > 0,"TRUE","FALSE") | table * everything works up to | where ITEM_COUNT > 1 and I'm getting results as anticipated. but the eval itself is failing. I've also attempted to add each of these evals via an appendpipe but to no avail. Thanks in advance!