Splunk Search

Curl command error - b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh:

kumarviv
Explorer

When im trying to pull data using Curl on my mac for command :

' curl -s -ku admin:admin -o ?Users/Vivek/Desktop/09012020.csv https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search=\"search index=network host=SGC01* OR host=APR01* earliest=09/01/2020:00:00:00 latest=09/01/2020:23:59:59 | rex field=_raw "^[^ \n]* (?P<host>[^ ]+)\s+%(?P<mnemonic>[^ ]+)[^ \n]* \[(?P<fault_code>[^\]]+)[^\[\n]*\[(?P<state>[^\]]+)\]\[(?P<severity>[a-z]+)\]\[(?P<dn_mo>.*)\]" | stats count by host mnemonic fault_code state severity dn_mo\" -d output_mode=csv --data-urlencode -d preview="False" '

I'm getting an error with rex segment saying 

b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh: -c: line 1: `]* (?P<host>[^ ]+)\\s+%(?P<mnemonic>[^ ]+)[^ '\n"

Need help to solve this problem as the customer has to pull ~10M records summary stats by various cateogries

 @Ayn @micahkemp @harsmarvania57 

Labels (1)

ITWhisperer
SplunkTrust
SplunkTrust

It looks like you are escape the wrong double quotes - try

' curl -s -ku admin:admin -o ?Users/Vivek/Desktop/09012020.csv https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=network host=SGC01* OR host=APR01* earliest=09/01/2020:00:00:00 latest=09/01/2020:23:59:59 | rex field=_raw \"^[^ \n]* (?P<host>[^ ]+)\s+%(?P<mnemonic>[^ ]+)[^ \n]* \[(?P<fault_code>[^\]]+)[^\[\n]*\[(?P<state>[^\]]+)\]\[(?P<severity>[a-z]+)\]\[(?P<dn_mo>.*)\]\" | stats count by host mnemonic fault_code state severity dn_mo" -d output_mode=csv --data-urlencode -d preview="False" '

kumarviv
Explorer

   

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please check carefully - for example you had "... -d search=\"search ..." whereas I had "... -d search="search ...". Having said that, perhaps you also need to escape the backslashes in the string

' curl -s -ku admin:admin -o ?Users/Vivek/Desktop/09012020.csv https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=network host=SGC01* OR host=APR01* earliest=09/01/2020:00:00:00 latest=09/01/2020:23:59:59 | rex field=_raw \"^[^ \\n]* (?P<host>[^ ]+)\\s+%(?P<mnemonic>[^ ]+)[^ \\n]* \\[(?P<fault_code>[^\\]]+)[^\\[\\n]*\\[(?P<state>[^\\]]+)\\]\\[(?P<severity>[a-z]+)\\]\\[(?P<dn_mo>.*)\\]\" | stats count by host mnemonic fault_code state severity dn_mo" -d output_mode=csv --data-urlencode -d preview="False" '

 

kumarviv
Explorer

still getting the same error : 

b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh: -c: line 1: `]* (?P<host>[^ ]+)\\s+%(?P<mnemonic>[^ ]+)[^ '\n"

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...