Hello,
I'm running a saved search which runs perfectly fine, but when I'm trying to use Report Builder I'm getting a 500 error code with the following message: SearchException: Error in 'eval' command: The expression is malformed.
The eval command looks like that:
eval r=[search host="myhost" sourcetype="mysourcetype" event="Searches" |dedup user| lookup UserDate user output user_date | eval today=relative_time(now(),"-d@d") | eval yesterday=relative_time(now(),"-1d@d") | eval valid=if(user_date>=yesterday AND user_activate<date,1,0) | stats sum(valid) as s | rename s as search]
It looks fine to me, and in light of the fact that it runs perfect, I find it kind of strange that I'm getting such response when trying to use Report Builder.
Will appreciate any help with that.
... View more