Getting Data In

Use of double qoutes in rex command arguments fails alerts in windows environment.

xli_splunk
Splunk Employee
Splunk Employee

Set up an alert with the search command:
source="C:\test\data\log1.txt" | rex v="(?.*)" | head 10
the alert has never been triggered, although the same search on Aplunk UI generates results.

0 Karma

ibob0304
Communicator

You should have tried by black slash \"(?.*)\"

0 Karma

xli_splunk
Splunk Employee
Splunk Employee

So don't use double quotes with rax command in scheduled searches for alerts. Just use a search like:
source="C:\test\data\log1.txt" | rex v=(?.*) | head 10
This works fine for alerts and is more readable.

ibob0304
Communicator
  " works fine on windows.
0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...