- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- 'ut_parse' and 'ut_shannon' not working?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
'ut_parse' and 'ut_shannon' not working?
i want to find very long URL queries. taking the search:
sourcetype=bro_dns | 'ut_parse(query)' | eval length=len(query) |search blah blah
I get the error: Error in 'SearchParser': Missing a search command before '''. Error at position '27' blah blah.
i get a similar error when i try the 'ut_shannon' to try obtain domain entropy. I have successfully installed URL Toolbox to Splunk apps. is there further configuration i'm missing?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If you're using the macro, you need to enclose the macro with backtick characters () and the macros are namedut_lookup(param1, paramX)as opposed to using the lookups:| lookup ut_shannon_lookup word as shannon_word | table word, shannon_word`
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did you use the tick: ` or a single quote: '
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Had the same issue,
Apps -> Manage Apps -> URL Toolbox -> View Objects.
I see a bunch of lookups listed, it looks like it got renamed to ut_shannon_lookup , ut_parse_simple_lookup and ut_parse_extended_lookup. This is for whatever version of URL toolbox I downloaded today for splunk 6.6.1.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@OP I have the same issue. Have you figured this out ? WHat was the problem ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Any fix to this? I'm seeing the same issue as well
Thx
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just replaced ut_parse with ut_parse_simple and was able to run my search
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
