topic Re: Splunk - Rest API - Curl - Failing with Unbalanced Quotes in Getting Data In

Splunk - Rest API - Curl - Failing with Unbalanced Quotes

Maries — Thu, 14 Mar 2024 04:02:15 GMT

Hi,

I'm trying to write data to outputlookup file by doing a REST API Call (by running a search query).

The below command works and writes data to outputlookup csv file when running the search directly from Splunk.

But this is not working when executing the above search using REST API.

Getting the below error "Unbalanced quotes" when running the below command

Getting the below error when running the below command

Error : Error in 'EvalCommand': The expression is malformed. An unexpected character is reached at '\'host_abc'.</msg></messages></response>

Appreciate your help.

Thank you

Re: Splunk - Rest API - Curl - Failing with Unbalanced Quotes

Karthi — Thu, 14 Mar 2024 06:15:25 GMT

Hi,

can you please remove the "\" and give a try

Re: Splunk - Rest API - Curl - Failing with Unbalanced Quotes

Maries — Thu, 14 Mar 2024 10:57:34 GMT

This is working when we query directly from Splunk Search..

But when we try hitting using curl and its failing .

curl -k -u admin:Vzadmin@12 https://dallpsplsh01sp.tpd-soe.net:8089/servicesNS/admin/SRE/search/jobs/export -d search="| stats count as field1 | eval field1="dallvcflwb110u,yes;dallvcflwb120u,yes" | eval field1=split(field1,";") | mvexpand field1 | rex field=field1 "(?<host>.*),(?<mode>.*)" | table host mode | outputlookup atlassian_maintenance.csv"

-bash: syntax error near unexpected token `?'

Re: Splunk - Rest API - Curl - Failing with Unbalanced Quotes

isoutamo — Thu, 14 Mar 2024 07:41:55 GMT

please don't add your admin user + it's pass to any posts. Or actually write those on cmd as those are stored into history files and/or are seen on process list! Much better way is to read those into variable and then use that on queries. You could do it like

read USERPASS admin:<your pass here> ^D curl -ku $USERPASS .....

Also don't add your real node name into examples!

As you are in linux/*nix you could replace those outer " with ' and then it should work. Then you are not needs \" inside your SPL.

In windows this didn't work ;-(

r. Ismo

Re: Splunk - Rest API - Curl - Failing with Unbalanced Quotes

kartm2020 — Thu, 14 Mar 2024 10:58:30 GMT

Hi Maries,

Please try with the below search