I am trying to eval a new field based on matching several sub searches. The issue is that these sub searches can potentially return an empty result which breaks the syntax of the eval command. Example:
index=A loglevel=error
| eval group=case(
[search "search string 1" | fields correlationField], "group 1",
[search "search string 2" | fields correlationField], "group 2"
1=1, "other")
In this example if "search string 1" is not found in the time range then an empty result is used for the condition for group 1, which causes an error:
Error in 'eval' command: The expression is malformed. An unexpected character is reached at ')
If you're just setting group value based on which search string returns results (and not passing the actual value from subsearch), you can try like this
index=A loglevel=error
| eval group=case(
[search "search string 1" | stats count as search ]>0, "group 1",
[search "search string 2" | stats count as search]>0, "group 2",
1=1, "other")
You can also try this
index=A loglevel=error
| appendcols [search "search string 1" | stats count by correlationField | table correlationField | rename correlationField as group1]
| appendcols [search "search string 2" | stats count by correlationField | table correlationField | rename correlationField as group1]
| eval group=case(isnotnull(group1),"group1", isnotnull(group2),"group2", 1=1,"other")
You'll need to add to your subsearch so there's always a correlationField. Maybe this will help.
index=A loglevel=error
| eval group=case(
[search "search string 1" | eval correlationField=if(isnull(correlationField),0,correlationField) | fields correlationField], "group 1",
[search "search string 2" | eval correlationField=if(isnull(correlationField),0,correlationField) | fields correlationField], "group 2"
1=1, "other")
This has the same problem. The issue isn't results without a correlationField, it's that the subsearch might return no results at all.