Splunk Search

REST API/Curl help

a212830
Champion

Hi,

I have a search that runs within Splunk, but when I try it via curl, I get an error. Hoping someone can help me...

Here's the command:

curl -k -u user:passwd --data-urlencode search="search index=coreops sourcetype=sitescope_monitorstat MonitorType=FileSystem remotehost=artp17 OR remotehost=artp21 OR remotehost=artp22 OR remotehost=artp23 OR remotehost=artp24 OR remotehost=artp25 OR remotehost=artp26 AND (FS_Name = "/fii*" OR FS_Name = "/dis*") earliest=-15m |dedup remotehost, FS_Name |eval FS_PercUsed=rtrim(Use,"%") |where FS_PercUsed > 50 |table _time, remotehost, FS_Name, FS_PercUsed" https://artp449:8089/servicesNS/admin/search/search/jobs/export

When I execute this, I get:

<?xml version='1.0' encoding='UTF-8'?>
<response><messages><msg type="FATAL">Error in 'eval' command: The expression is malformed. An unexpected character is reached at '%)'.</msg></messages></response>$

Tags (2)
0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Try single quotes around the percentage sign or escape double quotes

eval FS_PercUsed=rtrim(Use,'%')

or

eval FS_PercUsed=rtrim(Use,\"%\")

View solution in original post

Damien_Dallimor
Ultra Champion

Try single quotes around the percentage sign or escape double quotes

eval FS_PercUsed=rtrim(Use,'%')

or

eval FS_PercUsed=rtrim(Use,\"%\")

aweitzman
Motivator

It would be useful if you put the curl line and XML response in a Code Sample block instead of the way you have here, but based on what is visible here, it looks like you're not escaping the double-quotes on the inside of the search string. That will almost certainly cause issues.

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...