topic Re: Error in 'SearchParser': Missing a search command before '''. Error at position '264' of search query in Splunk Search

Error in 'SearchParser': Missing a search command before '''. Error at position '264' of search query

qhmassc — Wed, 06 Mar 2024 16:51:38 GMT

I configured a Macro name securemsg(1), I use this Marco in the following search:

....| eval log_info=_raw | 'securemsg(log_info)' | ....

When I run this search I got following error:

Error in 'SearchParser': Missing a search command before '''. Error at position '264' of search query 'search index="linuxos" sourcetype="syslog" host="C...{snipped} {errorcontext = fo=_raw | 'securemsg(}'.

Please help.

Thanks

Re: Error in 'SearchParser': Missing a search command before '''. Error at position '264' of search query

ITWhisperer — Wed, 06 Mar 2024 17:24:38 GMT

It looks like you are using single quotes around the macro rather than backquotes

Are you sure the macro expands correctly - try using <ctrl><shift>E to expand the macro

Re: Error in 'SearchParser': Missing a search command before '''. Error at position '264' of search query

qhmassc — Wed, 06 Mar 2024 17:56:21 GMT

I changed to ....| eval log_info=_raw | "securemsg(log_info)" | ..., but got the same error

how to use <ctrl><shift>E to expand the macro?

Thanks

Re: Error in 'SearchParser': Missing a search command before '''. Error at position '264' of search query

ITWhisperer — Wed, 06 Mar 2024 18:35:54 GMT

You have now used double quotes - try back quotes

Put your cursor in the search window and press <ctrl><shift>E keys together

Re: Error in 'SearchParser': Missing a search command before '''. Error at position '264' of search query

qhmassc — Wed, 06 Mar 2024 18:59:57 GMT

Thanks, You are right! Need to use back quotes