Hi,
I am new toSplunk. I have a requirement where I am invoking a splunk saved search from a shell script splunk search '|savedsearch "Myreport"'
.The saved search has a dboutput statement to update the extracted information from hunk into Oracle. My savedsearch looks something like this
Index=ABC|mysearch| table a, b, c, d, e
|dboutput database=XXX type=sql "INSERT INTO xyz
(v,w,x,y,z)
VALUES
($a$, $b$, $c$, $d$, $e$)"
When I run the script ,I am getting an error:
Error in 'savedsearch' command: Encountered the following error while building a search for saved search 'Myreport' : Error while replacing variable name='a'. Could not find variable in the argument map.
Has anyone encountered this issue? Is it not possible to directly run a saved search with db commands?
The problem is that the dollar $ sign is a special symbol in saved search to replace parameters. To use the literal $ symbol as required by the dboutput query, replace each $ with 2 $ symbols. So the resultant query should be like this
index=ABC|mysearch| table a, b, c, d, e
|dboutput database=XXX type=sql "INSERT INTO xyz
(v,w,x,y,z)
VALUES
($$a$$, $$b$$, $$c$$, $$d$$, $$e$$)"
The problem is that the dollar $ sign is a special symbol in saved search to replace parameters. To use the literal $ symbol as required by the dboutput query, replace each $ with 2 $ symbols. So the resultant query should be like this
index=ABC|mysearch| table a, b, c, d, e
|dboutput database=XXX type=sql "INSERT INTO xyz
(v,w,x,y,z)
VALUES
($$a$$, $$b$$, $$c$$, $$d$$, $$e$$)"
hi, I have a follow up question. How do I capture and verify the response(exit status) of this CLI savedsearch in the shell script? "$?" is 0 even if the query fails or there is no data to extract. I have to schedule another savedsearch based on whether the above search was successful or not. Thanks in advance for the help!!
It works! Thanks a ton!