Splunk Search

help on where command which is malformed

jip31
Motivator

hi

I have an issue in the where command below (The expression is malformed)
What is the problem please??

| eval PROCESS=case(process_name like "mfev%" OR process_name like "mcdatrep" OR process_name=="mcshield" OR process_name=="amupdate" OR process_name=="McScript_InUse" OR process_name=="macompatsvc" OR process_name=="FrameworkService" OR process_name=="McScanCheck", "TITI", process_name like "Wmi%", "WMI", process_name=="conhost", "CMD Windows console", process_name=="csrss" OR process_name=="System" OR process_name=="TiWorker" OR process_name=="msfeedssync" OR process_name=="dwm" OR process_name=="perf-test-9c" OR process_name like "SearchProtocolHost%" OR process_name like "RuntimeBroker%" OR process_name like "LogonUI%", "TUTU") 
| stats dc(eval(if(process_cpu_used_percent > 50,host,NULL))) as Total by PROCESS 
| where PROCESS==("TITI","TUTU")`
Tags (1)
0 Karma
1 Solution

tdoSplunk
Path Finder

Hi jip31,

why are you using a single quote at the end of this line? | where PROCESS==("TITI","TUTU")

because of the single quote a macro is expected.
remove the quote and/or replace with something like this

| where like(PROCESS,"TITI") OR like(PROCESS,"TUTU")

best regards

View solution in original post

0 Karma

tdoSplunk
Path Finder

Hi jip31,

why are you using a single quote at the end of this line? | where PROCESS==("TITI","TUTU")

because of the single quote a macro is expected.
remove the quote and/or replace with something like this

| where like(PROCESS,"TITI") OR like(PROCESS,"TUTU")

best regards

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...