topic Re: multiple lines in saved search in Getting Data In

multiple lines in saved search

tonopahtaos — Sat, 05 May 2012 00:09:00 GMT

Hi,

my saved search is very long. I want to put it in savedsearches.conf in multiple lines escaped through \

this is my search lines:

search = (sourcetype=syslog) \

| search NOT "DEBUG" \

| transaction host user maxspan=2s maxpause=2s \

| convert timeformat="...." ctime(_ctime) as time \

| (lots of more lines....)

This seems working unless I add 'convert' into my search. It breaks the whole search. Once I change everything to one line (by removing escape \ and \n), everything goes back to normal.

Is this a bug in somewhere in Splunk code? Why 'convert' is different?

Thanks

Re: multiple lines in saved search

ChrisG — Sun, 06 May 2012 15:12:52 GMT

The Search Reference topic on convert notes that it "is mostly deprecated, and its functionality has been re-worked as functions of the eval command such as strftime(), strptime(), or tostring()." Have you tried using eval instead?

Re: multiple lines in saved search

tonopahtaos — Sun, 06 May 2012 23:37:20 GMT

this is exact the problem was. thank you very much.

Re: multiple lines in saved search

tonopahtaos — Tue, 08 May 2012 22:51:10 GMT

Further testing found another problem:

the 'rename' command does not work this way. It is not deprecated, but it breaks the search if I put following two lines in my search:

rename aaa as bbb \

| other search conditions

So, I have to put at least one other command following 'rename' in the same line:

rename aaa as bbb | other search conditions