All Apps and Add-ons

Is it not possible to run splunk CLI savedsearch with dbouput from a shell script?

yelkey
Explorer

Hi,

I am new toSplunk. I have a requirement where I am invoking a splunk saved search from a shell script splunk search '|savedsearch "Myreport"'.The saved search has a dboutput statement to update the extracted information from hunk into Oracle. My savedsearch looks something like this

Index=ABC|mysearch| table a, b, c, d, e 
|dboutput database=XXX type=sql "INSERT INTO xyz 
                        (v,w,x,y,z) 
                        VALUES
                        ($a$, $b$, $c$, $d$, $e$)"

When I run the script ,I am getting an error:

Error in 'savedsearch' command: Encountered the following error while building a search for saved search 'Myreport' : Error while replacing variable name='a'. Could not find variable in the argument map. 

Has anyone encountered this issue? Is it not possible to directly run a saved search with db commands?

0 Karma
1 Solution

somesoni2
Revered Legend

The problem is that the dollar $ sign is a special symbol in saved search to replace parameters. To use the literal $ symbol as required by the dboutput query, replace each $ with 2 $ symbols. So the resultant query should be like this

index=ABC|mysearch| table a, b, c, d, e 
 |dboutput database=XXX type=sql "INSERT INTO xyz 
                         (v,w,x,y,z) 
                         VALUES
                         ($$a$$, $$b$$, $$c$$, $$d$$, $$e$$)"

View solution in original post

somesoni2
Revered Legend

The problem is that the dollar $ sign is a special symbol in saved search to replace parameters. To use the literal $ symbol as required by the dboutput query, replace each $ with 2 $ symbols. So the resultant query should be like this

index=ABC|mysearch| table a, b, c, d, e 
 |dboutput database=XXX type=sql "INSERT INTO xyz 
                         (v,w,x,y,z) 
                         VALUES
                         ($$a$$, $$b$$, $$c$$, $$d$$, $$e$$)"

yelkey
Explorer

hi, I have a follow up question. How do I capture and verify the response(exit status) of this CLI savedsearch in the shell script? "$?" is 0 even if the query fails or there is no data to extract. I have to schedule another savedsearch based on whether the above search was successful or not. Thanks in advance for the help!!

0 Karma

yelkey
Explorer

It works! Thanks a ton!

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...