Splunk Search

Error in Case Statement

strive
Influencer

Hi,

I have a case statement as mentioned below:

eval MODEVAL = case(mode=="modeA", if (FieldA!=0,FieldA/1024,NULL),mode=="modeB",lookup csv_modes Header1 AS mode_name OUTPUT mode)

I get an error. "Error in 'eval' command: The expression is malformed. Expected )."

If i replace the lookup with NULL part in the above expression, it works fine.
eval MODEVAL = case(mode=="modeA", if (FieldA!=0,FieldA/1024,NULL),mode=="modeB",NULL)

My CSV file is:

Header1,Header2
A,1
B,2

I even changed CSV to:

"Header1","Header2"
"A","1"
"B","2"

I get same error.

Please help.

Thanks
Strive

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Uh, that's not valid syntax for eval/case at all. You can't use just any command in the statement, it has to be one of those functions supported by eval.

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions

View solution in original post

0 Karma

Ayn
Legend

Uh, that's not valid syntax for eval/case at all. You can't use just any command in the statement, it has to be one of those functions supported by eval.

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...