All Apps and Add-ons

'ut_parse' and 'ut_shannon' not working?

loudainmarc
Explorer

i want to find very long URL queries. taking the search:
sourcetype=bro_dns | 'ut_parse(query)' | eval length=len(query) |search blah blah
I get the error: Error in 'SearchParser': Missing a search command before '''. Error at position '27' blah blah.
i get a similar error when i try the 'ut_shannon' to try obtain domain entropy. I have successfully installed URL Toolbox to Splunk apps. is there further configuration i'm missing?

Tags (1)

christoffertoft
Communicator

If you're using the macro, you need to enclose the macro with backtick characters () and the macros are namedut_lookup(param1, paramX)as opposed to using the lookups:| lookup ut_shannon_lookup word as shannon_word | table word, shannon_word`

0 Karma

pmeyerson
Path Finder

Did you use the tick: ` or a single quote: '

0 Karma

pmeyerson
Path Finder

Had the same issue,
Apps -> Manage Apps -> URL Toolbox -> View Objects.
I see a bunch of lookups listed, it looks like it got renamed to ut_shannon_lookup , ut_parse_simple_lookup and ut_parse_extended_lookup. This is for whatever version of URL toolbox I downloaded today for splunk 6.6.1.

0 Karma

adinu
New Member

@OP I have the same issue. Have you figured this out ? WHat was the problem ?

0 Karma

jwalzerpitt
Influencer

Any fix to this? I'm seeing the same issue as well

Thx

0 Karma

jwalzerpitt
Influencer

Just replaced ut_parse with ut_parse_simple and was able to run my search

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...