Hi; I have a query that ends as follows
| stats count(eval(HttpStatus LIKE "2__")) AS success
count(eval(HttpStatus LIKE "5__")) AS fail
count as total by host
And under the Splunk UI environment I get my results as desired.
But the issue I see is when I use the exact same query under the Splunk CLI/CURL call to the service, i get the following response
{'messages': [{'type': 'FATAL', 'text': "Error in 'stats' command: The eval expression for dynamic field 'eval(HttpStatus LIKE 2__)' is invalid. Error='The operator at '__' is invalid.'"}]}
I've tried different variations of encapsulating the "httpstatus" field but non of them were successful (tried escaping characters also)
Please advise in solving this issue
Much appreciated
Fixed by changing the encapsulate part of my function to not be lazy
search="' + search_query + '"
to
search=\'' + search_query + '\'
Hi h0riz0nhk,
this works just fine for me:
curl -k -u user:password https://hostname:8089/services/search/jobs/export --data-urlencode 'search=search index="_internal" | stats count(eval(sourcetype LIKE "splunk%")) AS st_splunk count AS total by host ' -d output_mode=csv
and the result is this:
host,"st_splunk",total
hostname,308212,310456
the important thing here is to use --data-urlencode
otherwise it will fail because of the "
.
Hope this helps ...
cheers, MuS
Sadly the --data-urlencode
didn't work for me, but finally found a solution
Essentially i had a query builder and had to encapsulate the search=\'' + search query +'\'
correctly
(was being lazy with search="' + search query +'"
)
It might help to post the real query, because so far there are only snippets of it. Also it would be good to tell what did not work with the --data-urlencode
.