topic Re: mismatch '[' in search in Splunk Search

mismatch '[' in search

dgadjov — Tue, 19 Mar 2013 21:15:05 GMT

Running this through the Splunk search I get no errors. However when I put this search in my Advance XML I get: mismatch '['

source="/usr/local/splunk/splunk_test/test_data/sample_data" _time=[ search source="/usr/local/splunk/splunk_test/test_data/sample_data" | stats latest(_time) as new_data | return $new_data] | table * | replace "Failed" with 0 "Passed" with 100 | appendpipe [stats avg(*) as *] | replace 0 with "Failed" 100 with "Passed"

Re: mismatch '[' in search

vincesesto — Mon, 28 Sep 2020 13:32:52 GMT

Hey dgagjov,

My guess would be that the characters in the search that you are doing are being recognized as xml tags and is confusing things. If you enclose your search in <![CDATA[ and ]]>, it will allow you to place anything into your search without there being any issue.

Eg:
<![CDATA[
source="/usr/local/splunk/splunk_test/test_data/sample_data" _time=[ search source="/usr/local/splunk/splunk_test/test_data/sample_data" | stats latest(_time) as new_data | return $new_data] | table * | replace "Failed" with 0 "Passed" with 100 | appendpipe [stats avg(*) as *] | replace 0 with "Failed" 100 with "Passed"
]]>

Let me know if you need me to elaborate, and let me know if this does not work.

Regards Vince

Re: mismatch '[' in search

dgadjov — Tue, 19 Mar 2013 21:35:02 GMT

This is actually the first thing that I tried when I got this error. With or without the CDATA the mismatch will occur.

Re: mismatch '[' in search

martin_mueller — Tue, 19 Mar 2013 22:39:53 GMT

My guess is your "return $new_value]" got turned into "return " because there was no such variable to substitute. Try escaping the dollar sign with another dollar sign like this: "return $$new_value]"

Re: mismatch '[' in search

dgadjov — Tue, 19 Mar 2013 23:17:35 GMT

Wow that works! What does the double dollar sign do to make this work?

Re: mismatch '[' in search

martin_mueller — Tue, 19 Mar 2013 23:19:28 GMT

$$ gets turned into $, much like \\ getting turned into \ in regular expressions. With a single dollar sign it's trying to substitute variables such as $foo$.