Splunk Search

How to use erex in a CLI search

jphilput1
Explorer

I'm running into an issue with the syntax for a CLI search using erex.

The problem seems to be with the double quotes. I've tried single quoting the erex examples and counter examples, but none of it seems effective.

This search works in the GUI:

index=name searchterm NOT otherterm |erex message examples="/foo/bar,/foobar" counterexamples="barfoo, foobar" |table item1,item2,item3,item4,item5 |uniq |sort item3

In the CLI, I've tried it a couple of different ways, and the closest I've gotten to a working search is:

index=name searchterm NOT otherterm |erex message examples='/foo/bar,/foobar' counterexamples='barfoo, foobar' |table item1,item2,item3,item4,item5 |uniq |sort item3

the CLI search results in "INFO: No matching fields exist"

Do any of you know what I'm doing wrong here?

Thanks!

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

What is the CLI command you're using?

Should be like this:

./splunk search 'index=name searchterm NOT otherterm |erex message examples="/foo/bar,/foobar" counterexamples="barfoo, foobar" |table item1,item2,item3,item4,item5 |uniq |sort item3'

View solution in original post

jkat54
SplunkTrust
SplunkTrust

What is the CLI command you're using?

Should be like this:

./splunk search 'index=name searchterm NOT otherterm |erex message examples="/foo/bar,/foobar" counterexamples="barfoo, foobar" |table item1,item2,item3,item4,item5 |uniq |sort item3'

jphilput1
Explorer

Thanks jkat54! That worked perfectly. Sorry for the delayed reply, work got in the way of work.

0 Karma

jkat54
SplunkTrust
SplunkTrust

No problem at all, thanks for coming back! @jphilput1

0 Karma

gabriel_vasseur
Contributor

I have never used the CLI, but I'm guessing from your description that it involves putting your SPL search string inside quotes and that the " inside your search are interfering with that? If that's the case, have you tried escaping all " with a backslash?

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...