topic Re: Why did Splunk 9.0.1 "Fail to parse templatized search for field 'i'"? in Splunk Search

Why did Splunk 9.0.1 "Fail to parse templatized search for field 'i'"?

yuanliu — Mon, 26 Sep 2022 21:06:51 GMT

I'm trying to use the Splunk 9 addition in foreach iteration with ITEM, but it always returns "Failed to parse templatized search for field 'i'" on my server, which runs 9.0.1.

| makeresults | eval i = mvrange(0,3) | foreach i [eval showme = <<ITEM>>]

I previously used <<ITEM>> on a laptop Splunk 9 and it didn't have this error.

Re: Why did Splunk 9.0.1 "Fail to parse templatized search for field 'i'"?

bowesmana — Tue, 27 Sep 2022 00:55:59 GMT

Not sure as I don't have Splunk 9, but that error typically occurs when you don't wrap the right hand side of eval in single quotes.

Just thinking that the value of <<ITEM>> in this case is a numeric 0 to 3, so normally if those numbers were fields, you'd have to wrap them in single quote, e.g.

| makeresults | eval 0=1 | eval x='0'*2

No idea if that is relevant here though

Re: Why did Splunk 9.0.1 "Fail to parse templatized search for field 'i'"?

yuanliu — Tue, 27 Sep 2022 04:07:54 GMT

Thank you, @bowesmana! Funny enough, change the test to

| makeresults | eval i = mvrange(0,3) | foreach i [eval showme = '<<ITEM>>']

(or its mvappend equivalent) does suppress the error, even though it doesn't assign any value to showme - which was my real problem. In fact, my initial code - for the real problem, used single quotes. No error but no value, hence the experimentation. Regardless, the subject question is answered.

Re: Why did Splunk 9.0.1 "Fail to parse templatized search for field 'i'"?

yuanliu — Tue, 27 Sep 2022 04:33:14 GMT

Read foreach again. It turns out that <<ITEM>> iterator requires mode=multivalue (a new flag in Splunk 9). A proper test construct should be

| makeresults | eval i = mvrange(0,3) | foreach i mode=multivalue [eval showme = mvappend(showme, "equals " . <<ITEM>>)]

i	showme
0 1 2	equals 0 equals 1 equals 2

Quote is irrelevant in simple field names.