topic Re: Curl command error - b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh: in Splunk Search

Curl command error - b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh:

kumarviv — Wed, 23 Sep 2020 09:32:06 GMT

When im trying to pull data using Curl on my mac for command :

' curl -s -ku admin:admin -o ?Users/Vivek/Desktop/09012020.csv https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search=\"search index=network host=SGC01* OR host=APR01* earliest=09/01/2020:00:00:00 latest=09/01/2020:23:59:59 | rex field=_raw "^[^ \n]* (?P<host>[^ ]+)\s+%(?P<mnemonic>[^ ]+)[^ \n]* \[(?P<fault_code>[^\]]+)[^\[\n]*\[(?P<state>[^\]]+)\]\[(?P<severity>[a-z]+)\]\[(?P<dn_mo>.*)\]" | stats count by host mnemonic fault_code state severity dn_mo\" -d output_mode=csv --data-urlencode -d preview="False" '

I'm getting an error with rex segment saying

b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh: -c: line 1: `]* (?P<host>[^ ]+)\\s+%(?P<mnemonic>[^ ]+)[^ '\n"

Need help to solve this problem as the customer has to pull ~10M records summary stats by various cateogries

@Ayn @micahkemp @harsmarvania57

Re: Curl command error - b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh:

ITWhisperer — Wed, 23 Sep 2020 09:50:02 GMT

It looks like you are escape the wrong double quotes - try

' curl -s -ku admin:admin -o ?Users/Vivek/Desktop/09012020.csv https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=network host=SGC01* OR host=APR01* earliest=09/01/2020:00:00:00 latest=09/01/2020:23:59:59 | rex field=_raw \"^[^ \n]* (?P<host>[^ ]+)\s+%(?P<mnemonic>[^ ]+)[^ \n]* \[(?P<fault_code>[^\]]+)[^\[\n]*\[(?P<state>[^\]]+)\]\[(?P<severity>[a-z]+)\]\[(?P<dn_mo>.*)\]\" | stats count by host mnemonic fault_code state severity dn_mo" -d output_mode=csv --data-urlencode -d preview="False" '

Re: Curl command error - b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh:

kumarviv — Wed, 23 Sep 2020 09:59:23 GMT

still getting the same error :

b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh: -c: line 1: `]* (?P<host>[^ ]+)\\s+%(?P<mnemonic>[^ ]+)[^ '\n"

Re: Curl command error - b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh:

kumarviv — Wed, 23 Sep 2020 10:22:57 GMT

Re: Curl command error - b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh:

ITWhisperer — Wed, 23 Sep 2020 10:42:16 GMT

Please check carefully - for example you had "... -d search=\"search ..." whereas I had "... -d search="search ...". Having said that, perhaps you also need to escape the backslashes in the string

' curl -s -ku admin:admin -o ?Users/Vivek/Desktop/09012020.csv https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=network host=SGC01* OR host=APR01* earliest=09/01/2020:00:00:00 latest=09/01/2020:23:59:59 | rex field=_raw \"^[^ \\n]* (?P<host>[^ ]+)\\s+%(?P<mnemonic>[^ ]+)[^ \\n]* \\[(?P<fault_code>[^\\]]+)[^\\[\\n]*\\[(?P<state>[^\\]]+)\\]\\[(?P<severity>[a-z]+)\\]\\[(?P<dn_mo>.*)\\]\" | stats count by host mnemonic fault_code state severity dn_mo" -d output_mode=csv --data-urlencode -d preview="False" '