topic Re: REST API/Curl help in Splunk Search

REST API/Curl help

a212830 — Mon, 28 Sep 2020 19:56:25 GMT

Hi,

I have a search that runs within Splunk, but when I try it via curl, I get an error. Hoping someone can help me...

Here's the command:

curl -k -u user:passwd --data-urlencode search="search index=coreops sourcetype=sitescope_monitorstat MonitorType=FileSystem remotehost=artp17 OR remotehost=artp21 OR remotehost=artp22 OR remotehost=artp23 OR remotehost=artp24 OR remotehost=artp25 OR remotehost=artp26 AND (FS_Name = "/fii*" OR FS_Name = "/dis*") earliest=-15m |dedup remotehost, FS_Name |eval FS_PercUsed=rtrim(Use,"%") |where FS_PercUsed > 50 |table _time, remotehost, FS_Name, FS_PercUsed" https://artp449:8089/servicesNS/admin/search/search/jobs/export

When I execute this, I get:

<?xml version='1.0' encoding='UTF-8'?>
<response><messages><msg type="FATAL">Error in 'eval' command: The expression is malformed. An unexpected character is reached at '%)'.</msg></messages></response>$

Re: REST API/Curl help

aweitzman — Mon, 11 May 2015 12:59:56 GMT

It would be useful if you put the curl line and XML response in a Code Sample block instead of the way you have here, but based on what is visible here, it looks like you're not escaping the double-quotes on the inside of the search string. That will almost certainly cause issues.

Re: REST API/Curl help

Damien_Dallimor — Mon, 11 May 2015 13:03:26 GMT

Try single quotes around the percentage sign or escape double quotes

eval FS_PercUsed=rtrim(Use,'%')

eval FS_PercUsed=rtrim(Use,\"%\")