Splunk Search

Why are we getting "invalid syntax" errors using and referencing generated field extractions in our alert searches?

pricea
Engager

When creating alerts in Splunk, we are trying to use generated field extractions and referencing them within our alert queries. When running the query in Search, there is no error. However, when trying to set an alert for the same query, we receive an error in our logs, stating that the query is in an invalid syntax (looking for the error now, we have since turned those jobs off to clean up our logs).

Any ideas or solutions to this problem would be greatly appreciated! It sounds like I could put the regex into the query, but I'd like to avoid this.

dolivasoh
Contributor

I would double check the permissions on the field extractions. The user you're running the scheduled search as which powers the alert much have read access to the extractions.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...