All Apps and Add-ons

Is it not possible to run splunk CLI savedsearch with dbouput from a shell script?

yelkey
Explorer

Hi,

I am new toSplunk. I have a requirement where I am invoking a splunk saved search from a shell script splunk search '|savedsearch "Myreport"'.The saved search has a dboutput statement to update the extracted information from hunk into Oracle. My savedsearch looks something like this

Index=ABC|mysearch| table a, b, c, d, e 
|dboutput database=XXX type=sql "INSERT INTO xyz 
                        (v,w,x,y,z) 
                        VALUES
                        ($a$, $b$, $c$, $d$, $e$)"

When I run the script ,I am getting an error:

Error in 'savedsearch' command: Encountered the following error while building a search for saved search 'Myreport' : Error while replacing variable name='a'. Could not find variable in the argument map. 

Has anyone encountered this issue? Is it not possible to directly run a saved search with db commands?

0 Karma
1 Solution

somesoni2
Revered Legend

The problem is that the dollar $ sign is a special symbol in saved search to replace parameters. To use the literal $ symbol as required by the dboutput query, replace each $ with 2 $ symbols. So the resultant query should be like this

index=ABC|mysearch| table a, b, c, d, e 
 |dboutput database=XXX type=sql "INSERT INTO xyz 
                         (v,w,x,y,z) 
                         VALUES
                         ($$a$$, $$b$$, $$c$$, $$d$$, $$e$$)"

View solution in original post

somesoni2
Revered Legend

The problem is that the dollar $ sign is a special symbol in saved search to replace parameters. To use the literal $ symbol as required by the dboutput query, replace each $ with 2 $ symbols. So the resultant query should be like this

index=ABC|mysearch| table a, b, c, d, e 
 |dboutput database=XXX type=sql "INSERT INTO xyz 
                         (v,w,x,y,z) 
                         VALUES
                         ($$a$$, $$b$$, $$c$$, $$d$$, $$e$$)"

yelkey
Explorer

hi, I have a follow up question. How do I capture and verify the response(exit status) of this CLI savedsearch in the shell script? "$?" is 0 even if the query fails or there is no data to extract. I have to schedule another savedsearch based on whether the above search was successful or not. Thanks in advance for the help!!

0 Karma

yelkey
Explorer

It works! Thanks a ton!

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...