Reporting

Error in 'Search Parser': Missing a closing tick mark for macro expansion.

Kamlesh1905
Engager

Dear Community Experts,

Need your urgent help on below error that I am getting when trying to run the below curl command, 

search="search index=perfmon_idx host=* `M_Performance(Perfmon:CPU Load,% Processor Time)` instance=_Total | timechart avg(Value) by host | eval warning_threshold = 70 | eval critical_threshold = 90" -d output_mode=json -d earliest_time="-60m@m" -d latest_time="-0m@m" -o C:\CPULog.txt

Error in 'SearchParser': Missing a closing tick mark for macro expansion.

Can someone please help me to understand what is missing here ?

 
 
 
 
Labels (2)
0 Karma
1 Solution

Kamlesh1905
Engager

I got the issue in this search, percent sign ( % ) was the culprit. Batch file doesn't support it so I have to use the escape char. I changed my query and it worked,

\%% Processor Time)` instance=_Total 

View solution in original post

tscroggins
Influencer

@Kamlesh1905 

I don't get exactly the same error, but curl on Windows may not be encoding the % correctly, giving unexpected results. Try explicitly encoding the % within the command-line:

curl ... -d search="search index=perfmon_idx host=* `M_Performance(Perfmon:CPU Load,%25 Processor Time)` instance=_Total | timechart avg(Value) by host | eval warning_threshold = 70 | eval critical_threshold = 90" -d output_mode=json -d earliest_time="-60m@m" -d latest_time="-0m@m" -o C:\CPULog.txt

0 Karma

Kamlesh1905
Engager

I got the issue in this search, percent sign ( % ) was the culprit. Batch file doesn't support it so I have to use the escape char. I changed my query and it worked,

\%% Processor Time)` instance=_Total 

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...