topic Re: SearchTemplate Query Error in Splunk Search

SearchTemplate Query Error

rkanalyst — Mon, 07 Mar 2011 19:30:28 GMT

I am facing the problem when i am adding "\" inside the searchTemplate query for conditional checks.The same query is working fine when used for the search but not inside searchTemplate .

Query inside SearchTemplate:

searchTemplate> tag="$tagname$" sourcetype="SrcFile" | eval series1=if(searchmatch("\"first String \" AND \"Second String\""),_time,null()) | timechart span="$splitinterval$" count(series1) as Request

   </searchTemplate>

ERROR ::

PARSER: Applying intentions failed Error in 'eval' command: The expression is malformed. Expected ).

Please provide any help if possible.I had tried the option for CData inside the tag.

Thanks in Advance!

Re: SearchTemplate Query Error

Paolo_Prigione — Mon, 07 Mar 2011 19:55:04 GMT

Have you tried to use ascii-html for troublesome characters? Try the following:

replace " (quote) with "
replace \ (backslash) with \

Re: SearchTemplate Query Error

rkanalyst — Mon, 07 Mar 2011 20:19:43 GMT

Thanks.
But I tried by changing the " and \ with the string you mentioned.But Still I am facing the same problem.

Re: SearchTemplate Query Error

Paolo_Prigione — Mon, 14 Mar 2011 01:24:40 GMT

Thanks for the update!

Re: SearchTemplate Query Error

rkanalyst — Mon, 08 Aug 2011 14:10:08 GMT

Got this error Resolved by using the macro. Putting this content in : sourcetype="SrcFile" | eval series1=if(searchmatch(""first String " AND "Second String""),_time,null()) a newly defined Macro.

I found other informations like 1)Backslah problem in splunk http://answers.splunk.com/questions/6563/backslash-escape-problem 2) Use search macro

http://www.splunk.com/base/Documentation/latest/User/CreateAndUseSearchMacros