Splunk Search

Why does my search return error "Unable to parse the search: Comparator '=' is missing a term on the right hand side"?

HealyDPS
Explorer

I had this search working and now it seems to have stopped gives an error. Thoughts?

Search:

index=symantec sourcetype=file Host_Name=[search index=dhcp "*ip address*" "DHCPACK" AND "RENEW"| sort by _time desc | rex "\((?.*?)\)"| dedup Hostname | table Hostname | return $Hostname] | dedup user | eval time=strftime(_time, "%m/%d/%Y %H:%M:%S") | table time,Host_Name,user,_raw

Error:

Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the right hand side.
0 Karma
1 Solution

harshal_chakran
Builder

Try using it like this:

 index=symantec sourcetype=file [search index=dhcp "Require for all Events or Make "*"" "DHCPACK" AND "RENEW"| sort by _time desc | rex "\((?.*?)\)"| dedup Hostname | table Hostname | rename Hostname as Host_Name] | dedup user | eval time=strftime(_time, "%m/%d/%Y %H:%M:%S") | table time,Host_Name,user,_raw

Removed the comparator and used subsearch.

View solution in original post

abhinav_maxonic
Path Finder

Check the macro definition in macros.conf at the location /opt/splunk/etc/apps/digitalguardian_web . In my case, the marco was wrongly defined.

$SPLUNK_HOME$/etc/apps/digitalguardian_web/local/macros.conf
Wrong Definition -
[index_macro]
definition = index=digitalguardian
Right Definition
[index_macro]
definition = digitalguardian

0 Karma

jplumsdaine22
Influencer

The error is most likely triggereing because the subsearch [search index=dhcp "Require for all Events or Make "*"" "DHCPACK" AND "RENEW"| sort by _time desc | rex "\((?.*?)\)"| dedup Hostname | table Hostname | return $Hostname] is resolving to NULL, therefore your outer search is being run as

index=symantec sourcetype=file Host_Name= | ... etc

Check that your subsearch returns results, either by running the search on its own or look in the job inspector

0 Karma

HealyDPS
Explorer

I did the sub search and I get the information I am looking for. So how would I fix this now? Also I put in the information wrong. I am added a more correct search string.

0 Karma

harshal_chakran
Builder

Try using it like this:

 index=symantec sourcetype=file [search index=dhcp "Require for all Events or Make "*"" "DHCPACK" AND "RENEW"| sort by _time desc | rex "\((?.*?)\)"| dedup Hostname | table Hostname | rename Hostname as Host_Name] | dedup user | eval time=strftime(_time, "%m/%d/%Y %H:%M:%S") | table time,Host_Name,user,_raw

Removed the comparator and used subsearch.

HealyDPS
Explorer

Thanks that worked. Plus I figured out why no results were coming back. Thanks again.

0 Karma

jplumsdaine22
Influencer

This is a saner method for sure

0 Karma

HealyDPS
Explorer

So I did this:

index=symantec sourcetype=symantecfield [search index=dhcp "ip" "DHCPACK" AND "RENEW"| sort by _time desc | rex "((?.*?))"| dedup Hostname | table Hostname | return $Hostname] | dedup user | eval time=strftime(_time, "%m/%d/%Y %H:%M:%S") | table time,Host_Name,user,_raw

No longer getting error but I am getting no results. But if I put the results of the subsearch in search I will get the results I want. Both searches seems to work by themselves but not together.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...