Hi all,
Getting this error:
Error in 'eval' command: The expression is malformed. Expected ).
I'm following the following tutorial:
https://www.splunk.com/blog/2017/06/01/enhancing-splunk-visualizations-with-mapbox.html
Everything was going fine until I got to the part of the search where I had to add the eval case statement color parameters. Can someone tell me where I'm going wrong? Thanks!
sourcetype="test" severity="critical" | iplocation src prefix=start_ | iplocation dest prefix=end_ | search start_Country="*" end_Country="*" | table start_lat start_lon end_lat end_lon app | eval animate="yes", pulse_at_start="yes" | eval color = case (
match(app, "ssh"), "#c0392b"
match(app, "web-browsing"), "#e67e22",
match(app, "unknown-tcp"), "#f1c40f",
match(app, "webdav"), "#27ae60",
1==1, "#7f8c8d")
It doesn't look like I'm missing anything..but then again..Its always better with another set of eyes:)
... View more