Thank you! Worked OK! I faced the same error. You helped a lot! 🙂 ... View more

@bpna  When using field names in statements that take an eval expression, like the where clause does, you will need to escape fields that do not contain 'simple' characters. In practice this means that any field starting with a numeric, or not contain only numbers and letters will need to be escaped by wrapping the field in single quotes, e.g. | where like('data.rule.name', "Target Trends.%") in this case, the . character needs to be escaped. See these links for a description (although they are SLP2, they apply here also) https://docs.splunk.com/Documentation/SCS/current/Search/Escapecharacters#Rules_for_when_to_use_escape_characters https://docs.splunk.com/Documentation/SCS/current/Search/Quotations ... View more