Splunk Search

eval with malformed in my nested if. Expected (.

peiyee422
New Member

Hi,

Need help urgently. I am running Splunk command in batch file but I keep on getting
FATAL: Error in 'eval' command: The expression is malformed. Expected ).

This is my command:
eval 1Status=if(Test_Result=""Passed"","No Issue",if(PreviousResult>0,"Known","New"))
Can anyone tell me what is wrong with this command?

Thank you so much!

Tags (3)
0 Karma

niketn
Legend

@peiyee422 Does your Test_Result value actually contain double quote in it?

If Not try the following:

| eval 1Status=if(Test_Result="Passed","No Issue",if(PreviousResult>0,"Known","New"))

If Not try the following which escapes double quotes in eval using \":

| eval 1Status=if(Test_Result="\"Passed\"","No Issue",if(PreviousResult>0,"Known","New"))
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

peiyee422
New Member

Hi, it is not working in these ways.
This is because I am running them in a batch file, it needs a escape brackets.

BUT I replaced the if statement with case:
eval Test_Status=case(Test_Result=""Passed"",""No Issue"",PreviousResult>0,""Known Issue"", PreviousResult=0,""New"")

0 Karma

niketn
Legend

What do you mean by running them in a batch file. Also are you still getting error? What do you mean by it is not working?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

peiyee422
New Member

I run the query in a batch file, still getting the same error.
Anyways, issue solved by using CASE.
Thank you so much for the comments!! 🙂 🙂

0 Karma

niketn
Legend

Good to know. Please post your solution and accept the same as answer to mark this question as answered!

Do up vote the comment/s that helped!

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...