Getting Data In

multiple lines in saved search

tonopahtaos
Path Finder

Hi,

my saved search is very long. I want to put it in savedsearches.conf in multiple lines escaped through \

this is my search lines:

search = (sourcetype=syslog) \

| search NOT "DEBUG" \

| transaction host user maxspan=2s maxpause=2s \

| convert timeformat="...." ctime(_ctime) as time \

| (lots of more lines....)

This seems working unless I add 'convert' into my search. It breaks the whole search. Once I change everything to one line (by removing escape \ and \n), everything goes back to normal.

Is this a bug in somewhere in Splunk code? Why 'convert' is different?

Thanks

0 Karma
1 Solution

ChrisG
Splunk Employee
Splunk Employee

The Search Reference topic on convert notes that it "is mostly deprecated, and its functionality has been re-worked as functions of the eval command such as strftime(), strptime(), or tostring()." Have you tried using eval instead?

View solution in original post

tonopahtaos
Path Finder

Further testing found another problem:

the 'rename' command does not work this way. It is not deprecated, but it breaks the search if I put following two lines in my search:

rename aaa as bbb \

| other search conditions

So, I have to put at least one other command following 'rename' in the same line:

rename aaa as bbb | other search conditions

0 Karma

ChrisG
Splunk Employee
Splunk Employee

The Search Reference topic on convert notes that it "is mostly deprecated, and its functionality has been re-worked as functions of the eval command such as strftime(), strptime(), or tostring()." Have you tried using eval instead?

tonopahtaos
Path Finder

this is exact the problem was. thank you very much.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...