topic Re: Unmatched parentheses error with replace in Splunk Search

Unmatched parentheses error with replace

bruceclarke — Wed, 09 Mar 2016 19:59:12 GMT

The following search is complaining about an unmatched parenthesis. Since the parentheses are inside of quotes, shouldn't the parser not care? Does anyone have a workaround?

{baseSearch}
| eval BaselineActual=replace(BaselineActual,") (",")<NEWLINE>(")
| makemv delim="<NEWLINE>" BaselineActual

Re: Unmatched parentheses error with replace

MuS — Wed, 09 Mar 2016 20:05:31 GMT

Hi bruceclarke,

you need to escape the parentheses so Splunk will not use them:

 | stats count | eval foo="This is ) ( my message" | eval BaselineActual=replace(foo,"\) \(",")<NEWLINE>(")
 | makemv delim="<NEWLINE>" BaselineActual

or adapted to your search:

 {baseSearch}
 | eval BaselineActual=replace(BaselineActual,"\) \(",")<NEWLINE>(")
 | makemv delim="<NEWLINE>" BaselineActual

Hope that helps ...

cheers, MuS

Re: Unmatched parentheses error with replace

bruceclarke — Wed, 09 Mar 2016 20:34:05 GMT

Thanks MuS! I was actually playing around with this more and came to a similar conclusion. Ultimately this didn't work for me either.

Turns out that what I assumed was a space might actually be some other whitespace character. I was able to use the following to get it to work (note that "\s" matches any whitespace character):
{baseSearch}
| eval BaselineActual=replace(BaselineActual,")\s(",")(")
| makemv delim="" BaselineActual