All Apps and Add-ons

'ut_parse' and 'ut_shannon' not working?

loudainmarc
Explorer

i want to find very long URL queries. taking the search:
sourcetype=bro_dns | 'ut_parse(query)' | eval length=len(query) |search blah blah
I get the error: Error in 'SearchParser': Missing a search command before '''. Error at position '27' blah blah.
i get a similar error when i try the 'ut_shannon' to try obtain domain entropy. I have successfully installed URL Toolbox to Splunk apps. is there further configuration i'm missing?

Tags (1)

christoffertoft
Communicator

If you're using the macro, you need to enclose the macro with backtick characters () and the macros are namedut_lookup(param1, paramX)as opposed to using the lookups:| lookup ut_shannon_lookup word as shannon_word | table word, shannon_word`

0 Karma

pmeyerson
Path Finder

Did you use the tick: ` or a single quote: '

0 Karma

pmeyerson
Path Finder

Had the same issue,
Apps -> Manage Apps -> URL Toolbox -> View Objects.
I see a bunch of lookups listed, it looks like it got renamed to ut_shannon_lookup , ut_parse_simple_lookup and ut_parse_extended_lookup. This is for whatever version of URL toolbox I downloaded today for splunk 6.6.1.

0 Karma

adinu
New Member

@OP I have the same issue. Have you figured this out ? WHat was the problem ?

0 Karma

jwalzerpitt
Influencer

Any fix to this? I'm seeing the same issue as well

Thx

0 Karma

jwalzerpitt
Influencer

Just replaced ut_parse with ut_parse_simple and was able to run my search

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...