topic getting the error in splunk query in Splunk Dev

getting the error in splunk query

nareshkareeti — Sun, 15 Jun 2025 17:47:46 GMT

| tstats summariesonly=true count From datamodel=Network_Traffic WHERE (All_Traffic.src_ip=* OR All_Traffic.dest_ip=*) | 'drop_dm_object_name("All_Traffic")' | lookup IOC_IPs.csv IP AS src_ip OUTPUT IP AS matched_src | lookup IOC_IPs.csv IP AS dest_ip OUTPUT IP AS matched_dest | where isnotnull (matched_src) OR where isnotnull(matched_dest)

Error in 'SearchParser': Missing a search command before '''. Error at position '121' of search query '| tstats summariesonly=true count From datamodel=N...{snipped} {errorcontext = t_ip=*) | 'drop_dm_ob}'

Re: getting the error in splunk query

sainag_splunk — Sun, 15 Jun 2025 21:44:07 GMT

@nareshkareeti try

| tstats summariesonly=true count FROM datamodel=Network_Traffic WHERE (All_Traffic.src_ip=* OR All_Traffic.dest_ip=*) BY All_Traffic.src_ip, All_Traffic.dest_ip | `drop_dm_object_name("All_Traffic")`

Re: getting the error in splunk query

bowesmana — Sun, 15 Jun 2025 23:32:04 GMT

Your SPL has "tick" marks round the macro drop_dm_object_name that are single quotes ('), whereas you need to use the backtick character (`)

| `drop_dm_object_name("All_Traffic")`