Is it not possible to run splunk CLI savedsearch with dbouput from a shell script?

[yelkey]

Hi,

I am new toSplunk. I have a requirement where I am invoking a splunk saved search from a shell script splunk search '|savedsearch "Myreport"'.The saved search has a dboutput statement to update the extracted information from hunk into Oracle. My savedsearch looks something like this

Index=ABC|mysearch| table a, b, c, d, e 
|dboutput database=XXX type=sql "INSERT INTO xyz 
                        (v,w,x,y,z) 
                        VALUES
                        ($a$, $b$, $c$, $d$, $e$)"

When I run the script ,I am getting an error:

Error in 'savedsearch' command: Encountered the following error while building a search for saved search 'Myreport' : Error while replacing variable name='a'. Could not find variable in the argument map. 

Has anyone encountered this issue? Is it not possible to directly run a saved search with db commands?

[somesoni2 · Accepted solution]

The problem is that the dollar $ sign is a special symbol in saved search to replace parameters. To use the literal $ symbol as required by the dboutput query, replace each $ with 2 $ symbols. So the resultant query should be like this

index=ABC|mysearch| table a, b, c, d, e 
 |dboutput database=XXX type=sql "INSERT INTO xyz 
                         (v,w,x,y,z) 
                         VALUES
                         ($$a$$, $$b$$, $$c$$, $$d$$, $$e$$)"

[yelkey]

hi, I have a follow up question. How do I capture and verify the response(exit status) of this CLI savedsearch in the shell script? "$?" is 0 even if the query fails or there is no data to extract. I have to schedule another savedsearch based on whether the above search was successful or not. Thanks in advance for the help!!

[yelkey]

It works! Thanks a ton!