Splunk Search

Curl command error - b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh:

kumarviv
Explorer

When im trying to pull data using Curl on my mac for command :

' curl -s -ku admin:admin -o ?Users/Vivek/Desktop/09012020.csv https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search=\"search index=network host=SGC01* OR host=APR01* earliest=09/01/2020:00:00:00 latest=09/01/2020:23:59:59 | rex field=_raw "^[^ \n]* (?P<host>[^ ]+)\s+%(?P<mnemonic>[^ ]+)[^ \n]* \[(?P<fault_code>[^\]]+)[^\[\n]*\[(?P<state>[^\]]+)\]\[(?P<severity>[a-z]+)\]\[(?P<dn_mo>.*)\]" | stats count by host mnemonic fault_code state severity dn_mo\" -d output_mode=csv --data-urlencode -d preview="False" '

I'm getting an error with rex segment saying 

b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh: -c: line 1: `]* (?P<host>[^ ]+)\\s+%(?P<mnemonic>[^ ]+)[^ '\n"

Need help to solve this problem as the customer has to pull ~10M records summary stats by various cateogries

 @Ayn @micahkemp @harsmarvania57 

Labels (1)

ITWhisperer
SplunkTrust
SplunkTrust

It looks like you are escape the wrong double quotes - try

' curl -s -ku admin:admin -o ?Users/Vivek/Desktop/09012020.csv https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=network host=SGC01* OR host=APR01* earliest=09/01/2020:00:00:00 latest=09/01/2020:23:59:59 | rex field=_raw \"^[^ \n]* (?P<host>[^ ]+)\s+%(?P<mnemonic>[^ ]+)[^ \n]* \[(?P<fault_code>[^\]]+)[^\[\n]*\[(?P<state>[^\]]+)\]\[(?P<severity>[a-z]+)\]\[(?P<dn_mo>.*)\]\" | stats count by host mnemonic fault_code state severity dn_mo" -d output_mode=csv --data-urlencode -d preview="False" '

kumarviv
Explorer

   

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please check carefully - for example you had "... -d search=\"search ..." whereas I had "... -d search="search ...". Having said that, perhaps you also need to escape the backslashes in the string

' curl -s -ku admin:admin -o ?Users/Vivek/Desktop/09012020.csv https://localhost:8089/servicesNS/admin/search/search/jobs/export -d search="search index=network host=SGC01* OR host=APR01* earliest=09/01/2020:00:00:00 latest=09/01/2020:23:59:59 | rex field=_raw \"^[^ \\n]* (?P<host>[^ ]+)\\s+%(?P<mnemonic>[^ ]+)[^ \\n]* \\[(?P<fault_code>[^\\]]+)[^\\[\\n]*\\[(?P<state>[^\\]]+)\\]\\[(?P<severity>[a-z]+)\\]\\[(?P<dn_mo>.*)\\]\" | stats count by host mnemonic fault_code state severity dn_mo" -d output_mode=csv --data-urlencode -d preview="False" '

 

kumarviv
Explorer

still getting the same error : 

b"/bin/sh: -c: line 1: syntax error near unexpected token `?P'\n/bin/sh: -c: line 1: `]* (?P<host>[^ ]+)\\s+%(?P<mnemonic>[^ ]+)[^ '\n"

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...