Unable to save correlation search in ITSI getting error "Invalid search string: This search cannot be parsed when parse_only is set to true."

bangalorep — Tue, 14 May 2019 10:29:50 GMT

Hello,

Using ITSI on Splunk Cloud.

Using the following search to create a correlation search

The search runs fine but when I try to save the correlation search, I get the error "Invalid search string: This search cannot be parsed when parse_only is set to true." which I found is a Javascript limitation. Any workaround for this?

Re: Unable to save correlation search in ITSI getting error "Invalid search string: This search cannot be parsed w

esnyder_splunk — Mon, 27 Jul 2020 05:41:52 GMT

You can't use a sub-search returning into an eval in a correlation search. As a workaround:

1. Create and save a basic correlation search with all of the information you want outside of the search.

2. As an admin user, go to Settings > Searches, reports, and alerts and open the correlation search you just created.

3. Add the sub-search you were trying to add there.

This workaround is also documented in known issue ITSI-3322 in the release notes.

topic Unable to save correlation search in ITSI getting error "Invalid search string: This search cannot be parsed when parse_only is set to true." in Splunk ITSI

Unable to save correlation search in ITSI getting error "Invalid search string: This search cannot be parsed when parse_only is set to true."

Re: Unable to save correlation search in ITSI getting error "Invalid search string: This search cannot be parsed w