How to use Rex Command in Python/C# SDK

harshal_chakran — Thu, 02 Jan 2014 09:11:58 GMT

Hi,

I have a CLI query which works perfectly on Splunk Web terminal and the same thing I want to replicate it using SDK

`sourcetype=csv| search 48,2 | rex field=_raw "(\d+,){0}(?<TableID>\d+)" | rex field=_raw "(\d+,){101}(?<Table_value>\d+)" | stats list(TableID) as Table, list(Table_value) as Value`

Now Problem is when I put above search query as search_query = "sourcetype=csv| search 48,2 | rex field=_raw "(\d+,){0}(?<TableID>\d+)" | rex field=_raw "(\d+,){101}(?<Table_value>\d+)" | stats list(TableID) as Table, list(Table_value) as Value" then due to " at the start and " before the "(\d+,){101} counts it as a sepreate string to which I used the following mechanism

`rex1 = "(\d+,){0}(?<TableID>\d+)"
rex2 = "(\d+,){101}(?<Table_value>\d+)"
query = "search sourcetype=csv| search 48,2 | rex field=_raw" + rex1 + "|rex field=_raw " + "|stats list(TableID) as Table, list(Table_value) as Value"`

But still it is not working. I get 400 - Bad Request Error. Same thing I even tried in C# SDK, there even "\" is a escape sequence, to resolve it I used @ but even in C# the error remained the same.

Kindly help me to resolve it, because there is no use of SDK as we are limited to not been able to use Rex and various other commands where "\" or any other escape sequence is used.

Re: How to use Rex Command in Python/C# SDK

jsie_splunk — Thu, 02 Jan 2014 16:31:53 GMT

In Python, you could use triple quotes to surround the string instead of the single quotes like so:

search_query = """sourcetype=csv| search 48,2 | rex field=_raw "(d+,){0}(?<tableid>d+)" | rex field=_raw "(d+,){101}(?<table_value>d+)" | stats list(TableID) as Table, list(Table_value) as Value"""

topic Re: How to use Rex Command in Python/C# SDK in Splunk Search

How to use Rex Command in Python/C# SDK

Re: How to use Rex Command in Python/C# SDK