I've discovered that if you have newlines in a stats command in a savedsearch like this:
| stats values(blah),
list(otherblah)
by field
running that | savedsearch <searchname>
will throw an error such as this:
{'fatal': ["Error in 'stats' command: The argument '\n' is invalid."],
We use spacing and newlines to make savedsearches easier to read across large teams. There are no issues using them through the UI, but it appears that calling them with savedsearch or curl throws this error.
It seems like a bug but I figured I'd check with the expert community first. I'm curious if anyone has seen this before or knows if its by design?
I opened a suppoort case and learned that this is bugs SPL-81061 and SPL-80985 and fixed in 6.0.4. http://docs.splunk.com/Documentation/Splunk/6.0.4/ReleaseNotes/6.0.4#Search.2C_saved_search.2C_alert...
I opened a suppoort case and learned that this is bugs SPL-81061 and SPL-80985 and fixed in 6.0.4. http://docs.splunk.com/Documentation/Splunk/6.0.4/ReleaseNotes/6.0.4#Search.2C_saved_search.2C_alert...