Hi,
I have a case statement as mentioned below:
eval MODEVAL = case(mode=="modeA", if (FieldA!=0,FieldA/1024,NULL),mode=="modeB",lookup csv_modes Header1 AS mode_name OUTPUT mode)
I get an error. "Error in 'eval' command: The expression is malformed. Expected )."
If i replace the lookup with NULL part in the above expression, it works fine.
eval MODEVAL = case(mode=="modeA", if (FieldA!=0,FieldA/1024,NULL),mode=="modeB",NULL)
My CSV file is:
Header1,Header2
A,1
B,2
I even changed CSV to:
"Header1","Header2"
"A","1"
"B","2"
I get same error.
Please help.
Thanks
Strive
Uh, that's not valid syntax for eval/case at all. You can't use just any command in the statement, it has to be one of those functions supported by eval.
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions
Uh, that's not valid syntax for eval/case at all. You can't use just any command in the statement, it has to be one of those functions supported by eval.
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions