How to use Rex Command in Python/C# SDK

[harshal_chakran]

Hi,

I have a CLI query which works perfectly on Splunk Web terminal and the same thing I want to replicate it using SDK

`sourcetype=csv| search 48,2 | rex field=_raw "(\d+,){0}(?<TableID>\d+)" | rex field=_raw "(\d+,){101}(?<Table_value>\d+)" | stats list(TableID) as Table, list(Table_value) as Value`

Now Problem is when I put above search query as search_query = "sourcetype=csv| search 48,2 | rex field=_raw "(\d+,){0}(?<TableID>\d+)" | rex field=_raw "(\d+,){101}(?<Table_value>\d+)" | stats list(TableID) as Table, list(Table_value) as Value" then due to " at the start and " before the "(\d+,){101} counts it as a sepreate string to which I used the following mechanism

`rex1 = "(\d+,){0}(?<TableID>\d+)"
rex2 = "(\d+,){101}(?<Table_value>\d+)"
query = "search sourcetype=csv| search 48,2 | rex field=_raw" + rex1 + "|rex field=_raw " + "|stats list(TableID) as Table, list(Table_value) as Value"`

But still it is not working. I get 400 - Bad Request Error. Same thing I even tried in C# SDK, there even "\" is a escape sequence, to resolve it I used @ but even in C# the error remained the same.

Kindly help me to resolve it, because there is no use of SDK as we are limited to not been able to use Rex and various other commands where "\" or any other escape sequence is used.

[jsie_splunk]

In Python, you could use triple quotes to surround the string instead of the single quotes like so:

search_query = """sourcetype=csv| search 48,2 | rex field=_raw "(d+,){0}(?<tableid>d+)" | rex field=_raw "(d+,){101}(?<table_value>d+)" | stats list(TableID) as Table, list(Table_value) as Value"""