Splunk Search

Error in 'SearchParser': Missing a search command before '''. Error at position '264' of search query

qhmassc
Explorer

I configured a Macro name securemsg(1), I use this Marco in the following search:

....| eval log_info=_raw | 'securemsg(log_info)' | ....

When I run this search I got following error:

Error in 'SearchParser': Missing a search command before '''. Error at position '264' of search query 'search index="linuxos" sourcetype="syslog" host="C...{snipped} {errorcontext = fo=_raw | 'securemsg(}'.

Please help.

Thanks

 

 

 

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You have now used double quotes - try back quotes

`

Put your cursor in the search window and press <ctrl><shift>E keys together

View solution in original post

0 Karma

qhmassc
Explorer

I changed to  ....| eval log_info=_raw | "securemsg(log_info)" | ..., but got the same error

how to use  <ctrl><shift>E to expand the macro?

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have now used double quotes - try back quotes

`

Put your cursor in the search window and press <ctrl><shift>E keys together

0 Karma

qhmassc
Explorer

Thanks, You are right!  Need to use back quotes

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like you are using single quotes around the macro rather than backquotes

Are you sure the macro expands correctly - try using <ctrl><shift>E to expand the macro

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...