Splunk Search

Why am I getting error "Comparator '=' is missing a term on the left hand side" using Java SDK setSearch method on JobResultsArgs?

csp_splunk
Engager

I am trying to use setSearch method on JobResultsArgs object to apply post process search to results.
I am using Java SDK .
Here is code -
JobResultsArgs jobRes = new JobResultsArgs();

String search = "search=sampleserchstring";
jobRes.setSearch(search);
InputStream resultsNormalSearch = job.getResults(jobRes);

I get following error after running this -

<msg type="FATAL">Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the left hand side.</msg>

What is wrong here?
I initially had put String search = "sampleserchstring"; but that does not work either.

Thanks.

Tags (3)
0 Karma
1 Solution

csp_splunk
Engager

I was making a mistake the search string should be something like -

String search = "search _raw=1234567";

View solution in original post

csp_splunk
Engager

I was making a mistake the search string should be something like -

String search = "search _raw=1234567";

gkanapathy
Splunk Employee
Splunk Employee

Actually you probably want String search = "search samplesearchstring". You generally don't want to search _raw=xyz, because that will only match if the entire raw string is xyz.

The general point is that the first word of the search is the command you want, and then it's followed by the arguments. Most of the time you just want search, but it's possible to use others, such as metadata or inputlookup.

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...