Hi,
I have a search that runs within Splunk, but when I try it via curl, I get an error. Hoping someone can help me...
Here's the command:
curl -k -u user:passwd --data-urlencode search="search index=coreops sourcetype=sitescope_monitorstat MonitorType=FileSystem remotehost=artp17 OR remotehost=artp21 OR remotehost=artp22 OR remotehost=artp23 OR remotehost=artp24 OR remotehost=artp25 OR remotehost=artp26 AND (FS_Name = "/fii*" OR FS_Name = "/dis*") earliest=-15m |dedup remotehost, FS_Name |eval FS_PercUsed=rtrim(Use,"%") |where FS_PercUsed > 50 |table _time, remotehost, FS_Name, FS_PercUsed" https://artp449:8089/servicesNS/admin/search/search/jobs/export
When I execute this, I get:
<?xml version='1.0' encoding='UTF-8'?>
<response><messages><msg type="FATAL">Error in 'eval' command: The expression is malformed. An unexpected character is reached at '%)'.</msg></messages></response>$
Try single quotes around the percentage sign or escape double quotes
eval FS_PercUsed=rtrim(Use,'%')
or
eval FS_PercUsed=rtrim(Use,\"%\")
Try single quotes around the percentage sign or escape double quotes
eval FS_PercUsed=rtrim(Use,'%')
or
eval FS_PercUsed=rtrim(Use,\"%\")
It would be useful if you put the curl
line and XML response in a Code Sample block instead of the way you have here, but based on what is visible here, it looks like you're not escaping the double-quotes on the inside of the search string. That will almost certainly cause issues.