hi
I have an issue in the where command below (The expression is malformed)
What is the problem please??
| eval PROCESS=case(process_name like "mfev%" OR process_name like "mcdatrep" OR process_name=="mcshield" OR process_name=="amupdate" OR process_name=="McScript_InUse" OR process_name=="macompatsvc" OR process_name=="FrameworkService" OR process_name=="McScanCheck", "TITI", process_name like "Wmi%", "WMI", process_name=="conhost", "CMD Windows console", process_name=="csrss" OR process_name=="System" OR process_name=="TiWorker" OR process_name=="msfeedssync" OR process_name=="dwm" OR process_name=="perf-test-9c" OR process_name like "SearchProtocolHost%" OR process_name like "RuntimeBroker%" OR process_name like "LogonUI%", "TUTU")
| stats dc(eval(if(process_cpu_used_percent > 50,host,NULL))) as Total by PROCESS
| where PROCESS==("TITI","TUTU")`
Hi jip31,
why are you using a single quote at the end of this line? | where PROCESS==("TITI","TUTU")
because of the single quote a macro is expected.
remove the quote and/or replace with something like this
| where like(PROCESS,"TITI") OR like(PROCESS,"TUTU")
best regards
Hi jip31,
why are you using a single quote at the end of this line? | where PROCESS==("TITI","TUTU")
because of the single quote a macro is expected.
remove the quote and/or replace with something like this
| where like(PROCESS,"TITI") OR like(PROCESS,"TUTU")
best regards