I was wondering if you found a solution for this issue? I came across the same issue with the SEDCMD not being able to look ahead long enough.  I am trying to truncate out a field from the JSON while keeping the rest intact. ... View more

For the first query for the Macros I had to add a rex command to get it to work | rest splunk_server=local /servicesNS/-/-/properties/macros | table id eai:acl.owner | rename eai:acl.owner as owner | fillnull value="-" owner | rex field=id mode=sed "s/https:\/\/127\.0\.0\.1:8089//" | map maxsearches=10000 search="| rest splunk_server=local $id$/definition | eval id=\"$id$\" | eval owner=\"$owner$\"" | where match(value,"YourSourceTypeHere*") | table id | rex field=id ".+\/(?<search>.+)$" | table search | eval search="search=*\" ".search." \"*" ... View more

I am pretty sure the errors are benign, it is coming from an internal Splunk ES process that it verifying the dashboards and the search parser that is checking is putting in the dummy "*" and then erroring out from it. It isn't actually ever trying to run that search. ... View more

I had a similar error for a different app, the issue was a corrupted download. If you try to untar it manually does it give an error? ... View more