license pool name : whitespace

[lculot]

Hi,

We noticed that spaces in license pool names are not escaped for some monitoring console license searches (historic data)

For a pool name like : My Pool

a license monitoring search will try 

search (index=_internal host=myserver source=*license_usage.log* type="RolloverSummary" earliest=-30d@d pool=My Pool) | eval _time=('_time' - 43200) | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [| search (index=_internal host=myserver source=*license_usage.log* type="RolloverSummary" earliest=-30d@d pool=My Pool) | eval _time=('_time' - 43200) | bin _time span=1d | stats latest(poolsz) AS "pool size" by _time] | fields - _timediff | foreach "*" [ eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3) ]

which produces no results because $pool_clause$ values are not in double quotes (pool="My Pool") or whitespace is not escaped (pool=My\ Pool)

Can we modify this behavior somewhere ?

[richgalloway]

You should be able to go to $SPLUNK_HOME/etc/splunk_monitoring_console/default, copy the relevant searches from savedsearches.conf to ../local/savedsearches.conf, then change $pool_clause$ to $pool_clause|s$.  Restart the MC instance and the searches should work better.

File a support request, too, so Splunk can fix that bug.

[lculot]

Thanks for the suggestion, as the pool_clause exist only in macros.conf we tried adding the change there but after restart search result throws

Unknown search command 's'

Because the historical data is new we will rename the pool without whitespace as a workaround (system/local/server.conf).