topic Re: Failed to parse templatized search for field.... in Splunk Search https://community.splunk.com/t5/Splunk-Search/Failed-to-parse-templatized-search-for-field/m-p/432157#M123475 <P>is that a JSON format data?<BR /> look into the <CODE>| spath</CODE> command</P> Fri, 15 Mar 2019 14:36:00 GMT adonio 2019-03-15T14:36:00Z Failed to parse templatized search for field.... https://community.splunk.com/t5/Splunk-Search/Failed-to-parse-templatized-search-for-field/m-p/432156#M123474 <P>Hi.</P> <P>I wonder whether someone may be able to help me please.</P> <P>I'm using the query below:</P> <PRE><CODE>| multisearch [ search `gateway_wmf(APIClientRequest)` path=*test*] [ search `wso2_wmf(APIRequestCompleted)` "request.detail.Context"=*test] | eval RequestID=coalesce('request.tags.X-Request-ID','requestID') | rename request.detail.applicationProductionClientId as ClientID | lookup consumercalls.csv ClientID OUTPUT Developer | eval header="" | foreach clientHeaders.test* [eval header=header+test&lt;&lt;MATCHSTR&gt;&gt;] | bucket span=10s _time | chart values(ClientID) as ClientID sum(clientHeaders.test*) as clientHeaders.test* by RequestID | fields - RequestID </CODE></PRE> <P>The query works except that on random days when I receive this error:</P> <BLOCKQUOTE> <P>Failed to parse templatized search for field 'clientHeaders.test-client-device-id{}'</P> </BLOCKQUOTE> <P>From comparing these dates I've discovered that it's because the fieldname has the {}.</P> <P>Could someone tell me please is there a way to get around this?</P> <P>Many thanks and kind regards</P> <P>Chris</P> Thu, 14 Mar 2019 14:46:34 GMT https://community.splunk.com/t5/Splunk-Search/Failed-to-parse-templatized-search-for-field/m-p/432156#M123474 IRHM73 2019-03-14T14:46:34Z Re: Failed to parse templatized search for field.... https://community.splunk.com/t5/Splunk-Search/Failed-to-parse-templatized-search-for-field/m-p/432157#M123475 <P>is that a JSON format data?<BR /> look into the <CODE>| spath</CODE> command</P> Fri, 15 Mar 2019 14:36:00 GMT https://community.splunk.com/t5/Splunk-Search/Failed-to-parse-templatized-search-for-field/m-p/432157#M123475 adonio 2019-03-15T14:36:00Z Re: Failed to parse templatized search for field.... https://community.splunk.com/t5/Splunk-Search/Failed-to-parse-templatized-search-for-field/m-p/432158#M123476 <P>Hi @adonio. Thank you for coming back to me with this.</P> <P>Yes the data is in a JSON style format, but this is a fieldname and not data which I have an issue with.</P> <P>Many thanks and kind regards</P> <P>Chris</P> Tue, 19 Mar 2019 07:25:09 GMT https://community.splunk.com/t5/Splunk-Search/Failed-to-parse-templatized-search-for-field/m-p/432158#M123476 IRHM73 2019-03-19T07:25:09Z Re: Failed to parse templatized search for field.... https://community.splunk.com/t5/Splunk-Search/Failed-to-parse-templatized-search-for-field/m-p/432159#M123477 <P>I saw a similar message below<BR /> [splunk-idx1] Failed to parse templatized search for field 'tag::eventtype'</P> <P>This error was caused by following forearch command.</P> <P><CODE>| foreach * <BR /> [ eval &lt;&lt;FIELD&gt;&gt; = if(isnull(&lt;&lt;FIELD&gt;&gt;),"",&lt;&lt;FIELD&gt;&gt;)]</CODE></P> <P>I think the &lt;&gt; template cannot handle fields contains special characters. I worked around this by adding <CODE>| fields - tag::eventtype</CODE> just before the foreach.<BR /> You can probably work around by adding <CODE>| fields - 'clientHeaders.test-client-device-id{}'</CODE></P> Wed, 21 Aug 2019 09:23:16 GMT https://community.splunk.com/t5/Splunk-Search/Failed-to-parse-templatized-search-for-field/m-p/432159#M123477 tmurata_splunk 2019-08-21T09:23:16Z