I am facing the problem when i am adding "\" inside the searchTemplate query for conditional checks.The same query is working fine when used for the search but not inside searchTemplate .
Query inside SearchTemplate:
searchTemplate> tag="$tagname$" sourcetype="SrcFile" | eval series1=if(searchmatch("\"first String \" AND \"Second String\""),_time,null()) | timechart span="$splitinterval$" count(series1) as Request
PARSER: Applying intentions failed Error in 'eval' command: The expression is malformed. Expected ).
Please provide any help if possible.I had tried the option for CData inside the tag.
Thanks in Advance!
Got this error Resolved by using the macro. Putting this content in : sourcetype="SrcFile" | eval series1=if(searchmatch(""first String " AND "Second String""),_time,null()) a newly defined Macro.
I found other informations like 1)Backslah problem in splunk http://answers.splunk.com/questions/6563/backslash-escape-problem 2) Use search macro