Splunk Search

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '[|

sharma11031988
Explorer

Hello All,

I am trying to remove events from my Dashboards for a specific time frame using data input from lookup.

I was able to use something from a blog, https://answers.splunk.com/answers/659389/how-to-exclude-multiple-time-ranges-from-multiple.html , and use this code to remove events:(This is the only format with which I can remove my event)

if(([| inputlookup exclusion.csv | convert timeformat="%b/%d/%Y %H:%M:%S" mktime(EndTime) mktime(StartTime) | eval search="_time>=".StartTime." AND _time<=".EndTime | return 500 $search]),"false","true")

However, when I enable acceleration on my Data model, I am getting a syntax error for a condition put in DM like this, while same works fine without acceleration

Error in 'eval' command: The expression is malformed. An unexpected character is reached at '[| inputlookup exclusion.csv | convert timeformat="%b/%d/%Y %H:%M:%S" mktime(EndTime) mktime(StartTime) | eval search="_time>=".StartTime." AND _time<=".EndTime | return 500 $search] ,"false","true")'

Can anyone help me figure out what am I doing wrong?

Tags (2)
0 Karma

samsplunks
Explorer

Hard a hard time debugging that one.

It only works if your SPL code with subquery return is in a dashboard "base search".

<dashboard>
  <label>My dashboard title</label>
<search id="parent_search_1">
    <query>``` put your query here with your subquery return $ ```</query>
</search>
<row>
<panel>
<table>
<title>My child visualization</title>
<search base="parent_search_1">
<query>``` have the rest of your query there ```</query>

 

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...