Getting Data In

Use of double qoutes in rex command arguments fails alerts in windows environment.

Splunk Employee
Splunk Employee

Set up an alert with the search command:
source="C:\test\data\log1.txt" | rex v="(?.*)" | head 10
the alert has never been triggered, although the same search on Aplunk UI generates results.

0 Karma

Communicator

You should have tried by black slash \"(?.*)\"

0 Karma

Splunk Employee
Splunk Employee

So don't use double quotes with rax command in scheduled searches for alerts. Just use a search like:
source="C:\test\data\log1.txt" | rex v=(?.*) | head 10
This works fine for alerts and is more readable.

Communicator
  " works fine on windows.
0 Karma