All Apps and Add-ons

'ut_parse' and 'ut_shannon' not working?

loudainmarc
Explorer

i want to find very long URL queries. taking the search:
sourcetype=bro_dns | 'ut_parse(query)' | eval length=len(query) |search blah blah
I get the error: Error in 'SearchParser': Missing a search command before '''. Error at position '27' blah blah.
i get a similar error when i try the 'ut_shannon' to try obtain domain entropy. I have successfully installed URL Toolbox to Splunk apps. is there further configuration i'm missing?

Tags (1)

christoffertoft
Communicator

If you're using the macro, you need to enclose the macro with backtick characters () and the macros are namedut_lookup(param1, paramX)as opposed to using the lookups:| lookup ut_shannon_lookup word as shannon_word | table word, shannon_word`

0 Karma

pmeyerson
Path Finder

Did you use the tick: ` or a single quote: '

0 Karma

pmeyerson
Path Finder

Had the same issue,
Apps -> Manage Apps -> URL Toolbox -> View Objects.
I see a bunch of lookups listed, it looks like it got renamed to ut_shannon_lookup , ut_parse_simple_lookup and ut_parse_extended_lookup. This is for whatever version of URL toolbox I downloaded today for splunk 6.6.1.

0 Karma

adinu
New Member

@OP I have the same issue. Have you figured this out ? WHat was the problem ?

0 Karma

jwalzerpitt
Motivator

Any fix to this? I'm seeing the same issue as well

Thx

0 Karma

jwalzerpitt
Motivator

Just replaced ut_parse with ut_parse_simple and was able to run my search

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!