Reporting

Error in 'Search Parser': Missing a closing tick mark for macro expansion.

Kamlesh1905
Engager

Dear Community Experts,

Need your urgent help on below error that I am getting when trying to run the below curl command, 

search="search index=perfmon_idx host=* `M_Performance(Perfmon:CPU Load,% Processor Time)` instance=_Total | timechart avg(Value) by host | eval warning_threshold = 70 | eval critical_threshold = 90" -d output_mode=json -d earliest_time="-60m@m" -d latest_time="-0m@m" -o C:\CPULog.txt

Error in 'SearchParser': Missing a closing tick mark for macro expansion.

Can someone please help me to understand what is missing here ?

 
 
 
 
Labels (2)
0 Karma
1 Solution

Kamlesh1905
Engager

I got the issue in this search, percent sign ( % ) was the culprit. Batch file doesn't support it so I have to use the escape char. I changed my query and it worked,

\%% Processor Time)` instance=_Total 

View solution in original post

tscroggins
Builder

@Kamlesh1905 

I don't get exactly the same error, but curl on Windows may not be encoding the % correctly, giving unexpected results. Try explicitly encoding the % within the command-line:

curl ... -d search="search index=perfmon_idx host=* `M_Performance(Perfmon:CPU Load,%25 Processor Time)` instance=_Total | timechart avg(Value) by host | eval warning_threshold = 70 | eval critical_threshold = 90" -d output_mode=json -d earliest_time="-60m@m" -d latest_time="-0m@m" -o C:\CPULog.txt

0 Karma

Kamlesh1905
Engager

I got the issue in this search, percent sign ( % ) was the culprit. Batch file doesn't support it so I have to use the escape char. I changed my query and it worked,

\%% Processor Time)` instance=_Total 

View solution in original post