https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72641#M14014 <P>i haven't changed anything.</P> Thu, 27 Sep 2012 09:15:45 GMT alenseb 2012-09-27T09:15:45Z https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72637#M14010 <P>Hi,</P> <P>I am trying to access one of my saved Searches, but this error is shown all of a sudden.<BR /> My syntax is correct as the same code was working sometime back.<BR /> Is this a product bug?</P> <P>Please help.</P> <P>Thanks!!</P> Thu, 27 Sep 2012 07:30:44 GMT https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72637#M14010 alenseb 2012-09-27T07:30:44Z https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72638#M14011 <P>We need to see the actual search text. Go to the Manager and edit the saved search. Copy the search into a comment.</P> Thu, 27 Sep 2012 07:36:28 GMT https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72638#M14011 lguinn2 2012-09-27T07:36:28Z https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72639#M14012 <P>The search works just fine, but when i search as a | savedsearch i get the error.</P> <P>Also the same SavedSearch command was working fine sometime back.</P> Thu, 27 Sep 2012 07:46:57 GMT https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72639#M14012 alenseb 2012-09-27T07:46:57Z https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72640#M14013 <P>so what did change since it last was working?</P> Thu, 27 Sep 2012 09:07:51 GMT https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72640#M14013 MuS 2012-09-27T09:07:51Z https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72641#M14014 <P>i haven't changed anything.</P> Thu, 27 Sep 2012 09:15:45 GMT https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72641#M14014 alenseb 2012-09-27T09:15:45Z https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72642#M14015 <P>Just read somewhere for these of errors, you have to re-install.<BR /> Any idea on why?</P> Thu, 27 Sep 2012 09:16:29 GMT https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72642#M14015 alenseb 2012-09-27T09:16:29Z https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72643#M14016 <P>to get help you need to give more infos:<BR /> -post the complete search<BR /> -splunk version<BR /> -permissions of the searches/report/dashboards/apps...</P> Thu, 27 Sep 2012 13:00:44 GMT https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72643#M14016 MarioM 2012-09-27T13:00:44Z https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72644#M14017 <P>I discovered today that after modifying a saved search to format it for better readability, this error showed up. The problem was that in formatting it, I added some CRLF characters. Afterwards, the error showed up. For some reason, CRLF are NOT ignored, but affect the search string. Hopefully this can help your situation. (I HATE unformatted search strings, too difficult to read when all jumbled up!)</P> Wed, 13 Nov 2013 18:42:48 GMT https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72644#M14017 ryonts 2013-11-13T18:42:48Z https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72645#M14018 <P>I discovered today that after modifying a saved search to format it for better readability, this error showed up. The problem was that in formatting it, I added some CRLF characters. Afterwards, the error showed up. For some reason, CRLF are NOT ignored, but affect the search string. Hopefully this can help your situation. (I HATE unformatted search strings, too difficult to read when all jumbled up!)</P> Wed, 13 Nov 2013 18:42:54 GMT https://community.splunk.com/t5/Security/Error-in-SearchParser-Missing-a-search-command-before/m-p/72645#M14018 ryonts 2013-11-13T18:42:54Z