Splunk Search

How to use Rex Command in Python/C# SDK

harshal_chakran
Builder

Hi,

I have a CLI query which works perfectly on Splunk Web terminal and the same thing I want to replicate it using SDK

`sourcetype=csv| search 48,2 | rex field=_raw "(\d+,){0}(?<TableID>\d+)" | rex field=_raw "(\d+,){101}(?<Table_value>\d+)" | stats list(TableID) as Table, list(Table_value) as Value`

Now Problem is when I put above search query as search_query = "sourcetype=csv| search 48,2 | rex field=_raw "(\d+,){0}(?<TableID>\d+)" | rex field=_raw "(\d+,){101}(?<Table_value>\d+)" | stats list(TableID) as Table, list(Table_value) as Value" then due to " at the start and " before the "(\d+,){101} counts it as a sepreate string to which I used the following mechanism

`rex1 = "(\d+,){0}(?<TableID>\d+)"
rex2 = "(\d+,){101}(?<Table_value>\d+)"
query = "search sourcetype=csv| search 48,2 | rex field=_raw" + rex1 + "|rex field=_raw " + "|stats list(TableID) as Table, list(Table_value) as Value"`

But still it is not working. I get 400 - Bad Request Error. Same thing I even tried in C# SDK, there even "\" is a escape sequence, to resolve it I used @ but even in C# the error remained the same.

Kindly help me to resolve it, because there is no use of SDK as we are limited to not been able to use Rex and various other commands where "\" or any other escape sequence is used.

Tags (5)
0 Karma

jsie_splunk
Splunk Employee
Splunk Employee

In Python, you could use triple quotes to surround the string instead of the single quotes like so:

search_query = """sourcetype=csv| search 48,2 | rex field=_raw "(d+,){0}(?<tableid>d+)" | rex field=_raw "(d+,){101}(?<table_value>d+)" | stats list(TableID) as Table, list(Table_value) as Value"""
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!