Splunk Search

Error in 'SearchParser': Missing a search command before '''. Error at position '264' of search query

qhmassc
Explorer

I configured a Macro name securemsg(1), I use this Marco in the following search:

....| eval log_info=_raw | 'securemsg(log_info)' | ....

When I run this search I got following error:

Error in 'SearchParser': Missing a search command before '''. Error at position '264' of search query 'search index="linuxos" sourcetype="syslog" host="C...{snipped} {errorcontext = fo=_raw | 'securemsg(}'.

Please help.

Thanks

 

 

 

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You have now used double quotes - try back quotes

`

Put your cursor in the search window and press <ctrl><shift>E keys together

View solution in original post

0 Karma

qhmassc
Explorer

I changed to  ....| eval log_info=_raw | "securemsg(log_info)" | ..., but got the same error

how to use  <ctrl><shift>E to expand the macro?

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You have now used double quotes - try back quotes

`

Put your cursor in the search window and press <ctrl><shift>E keys together

0 Karma

qhmassc
Explorer

Thanks, You are right!  Need to use back quotes

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It looks like you are using single quotes around the macro rather than backquotes

Are you sure the macro expands correctly - try using <ctrl><shift>E to expand the macro

0 Karma
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...