Splunk Search

newlines in stats command failure with savedsearch

sloshburch
Splunk Employee
Splunk Employee

I've discovered that if you have newlines in a stats command in a savedsearch like this:

| stats values(blah),
  list(otherblah)
 by field

running that | savedsearch <searchname> will throw an error such as this:

{'fatal': ["Error in 'stats' command: The argument '\n' is invalid."],

We use spacing and newlines to make savedsearches easier to read across large teams. There are no issues using them through the UI, but it appears that calling them with savedsearch or curl throws this error.

It seems like a bug but I figured I'd check with the expert community first. I'm curious if anyone has seen this before or knows if its by design?

Tags (3)
1 Solution

sloshburch
Splunk Employee
Splunk Employee

I opened a suppoort case and learned that this is bugs SPL-81061 and SPL-80985 and fixed in 6.0.4. http://docs.splunk.com/Documentation/Splunk/6.0.4/ReleaseNotes/6.0.4#Search.2C_saved_search.2C_alert...

View solution in original post

0 Karma

sloshburch
Splunk Employee
Splunk Employee

I opened a suppoort case and learned that this is bugs SPL-81061 and SPL-80985 and fixed in 6.0.4. http://docs.splunk.com/Documentation/Splunk/6.0.4/ReleaseNotes/6.0.4#Search.2C_saved_search.2C_alert...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...