All Apps and Add-ons

Is it not possible to run splunk CLI savedsearch with dbouput from a shell script?

yelkey
Explorer

Hi,

I am new toSplunk. I have a requirement where I am invoking a splunk saved search from a shell script splunk search '|savedsearch "Myreport"'.The saved search has a dboutput statement to update the extracted information from hunk into Oracle. My savedsearch looks something like this

Index=ABC|mysearch| table a, b, c, d, e 
|dboutput database=XXX type=sql "INSERT INTO xyz 
                        (v,w,x,y,z) 
                        VALUES
                        ($a$, $b$, $c$, $d$, $e$)"

When I run the script ,I am getting an error:

Error in 'savedsearch' command: Encountered the following error while building a search for saved search 'Myreport' : Error while replacing variable name='a'. Could not find variable in the argument map. 

Has anyone encountered this issue? Is it not possible to directly run a saved search with db commands?

0 Karma
1 Solution

somesoni2
Revered Legend

The problem is that the dollar $ sign is a special symbol in saved search to replace parameters. To use the literal $ symbol as required by the dboutput query, replace each $ with 2 $ symbols. So the resultant query should be like this

index=ABC|mysearch| table a, b, c, d, e 
 |dboutput database=XXX type=sql "INSERT INTO xyz 
                         (v,w,x,y,z) 
                         VALUES
                         ($$a$$, $$b$$, $$c$$, $$d$$, $$e$$)"

View solution in original post

somesoni2
Revered Legend

The problem is that the dollar $ sign is a special symbol in saved search to replace parameters. To use the literal $ symbol as required by the dboutput query, replace each $ with 2 $ symbols. So the resultant query should be like this

index=ABC|mysearch| table a, b, c, d, e 
 |dboutput database=XXX type=sql "INSERT INTO xyz 
                         (v,w,x,y,z) 
                         VALUES
                         ($$a$$, $$b$$, $$c$$, $$d$$, $$e$$)"

yelkey
Explorer

hi, I have a follow up question. How do I capture and verify the response(exit status) of this CLI savedsearch in the shell script? "$?" is 0 even if the query fails or there is no data to extract. I have to schedule another savedsearch based on whether the above search was successful or not. Thanks in advance for the help!!

0 Karma

yelkey
Explorer

It works! Thanks a ton!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...