Splunk Search

Curl command error - b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh:

kumarviv
Explorer

When im trying to pull data using Curl on my mac for command :

' curl -s -ku admin:admin -o ?Users/Vivek/Desktop/09012020.csv https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search=\"search index=network host=SGC01* OR host=APR01* earliest=09/01/2020:00:00:00 latest=09/01/2020:23:59:59 | rex field=_raw "^[^ \n]* (?P<host>[^ ]+)\s+%(?P<mnemonic>[^ ]+)[^ \n]* \[(?P<fault_code>[^\]]+)[^\[\n]*\[(?P<state>[^\]]+)\]\[(?P<severity>[a-z]+)\]\[(?P<dn_mo>.*)\]" | stats count by host mnemonic fault_code state severity dn_mo\" -d output_mode=csv --data-urlencode -d preview="False" '

I'm getting an error with rex segment saying 

b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh: -c: line 1: `]* (?P<host>[^ ]+)\\s+%(?P<mnemonic>[^ ]+)[^ '\n"

Need help to solve this problem as the customer has to pull ~10M records summary stats by various cateogries

 @Ayn @micahkemp @harsmarvania57 

Labels (1)

ITWhisperer
SplunkTrust
SplunkTrust

It looks like you are escape the wrong double quotes - try

' curl -s -ku admin:admin -o ?Users/Vivek/Desktop/09012020.csv https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=network host=SGC01* OR host=APR01* earliest=09/01/2020:00:00:00 latest=09/01/2020:23:59:59 | rex field=_raw \"^[^ \n]* (?P<host>[^ ]+)\s+%(?P<mnemonic>[^ ]+)[^ \n]* \[(?P<fault_code>[^\]]+)[^\[\n]*\[(?P<state>[^\]]+)\]\[(?P<severity>[a-z]+)\]\[(?P<dn_mo>.*)\]\" | stats count by host mnemonic fault_code state severity dn_mo" -d output_mode=csv --data-urlencode -d preview="False" '

kumarviv
Explorer

   

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please check carefully - for example you had "... -d search=\"search ..." whereas I had "... -d search="search ...". Having said that, perhaps you also need to escape the backslashes in the string

' curl -s -ku admin:admin -o ?Users/Vivek/Desktop/09012020.csv https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=network host=SGC01* OR host=APR01* earliest=09/01/2020:00:00:00 latest=09/01/2020:23:59:59 | rex field=_raw \"^[^ \\n]* (?P<host>[^ ]+)\\s+%(?P<mnemonic>[^ ]+)[^ \\n]* \\[(?P<fault_code>[^\\]]+)[^\\[\\n]*\\[(?P<state>[^\\]]+)\\]\\[(?P<severity>[a-z]+)\\]\\[(?P<dn_mo>.*)\\]\" | stats count by host mnemonic fault_code state severity dn_mo" -d output_mode=csv --data-urlencode -d preview="False" '

 

kumarviv
Explorer

still getting the same error : 

b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh: -c: line 1: `]* (?P<host>[^ ]+)\\s+%(?P<mnemonic>[^ ]+)[^ '\n"

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...