Splunk Search

REST API/Curl help



I have a search that runs within Splunk, but when I try it via curl, I get an error. Hoping someone can help me...

Here's the command:

curl -k -u user:passwd --data-urlencode search="search index=coreops sourcetype=sitescopemonitorstat MonitorType=FileSystem remotehost=artp17 OR remotehost=artp21 OR remotehost=artp22 OR remotehost=artp23 OR remotehost=artp24 OR remotehost=artp25 OR remotehost=artp26 AND (FSName = "/fii" OR FS_Name = "/dis") earliest=-15m |dedup remotehost, FSName |eval FSPercUsed=rtrim(Use,"%") |where FSPercUsed > 50 |table _time, remotehost, FSName, FS_PercUsed" https://artp449:8089/servicesNS/admin/search/search/jobs/export

When I execute this, I get:

<?xml version='1.0' encoding='UTF-8'?>
<response><messages><msg type="FATAL">Error in 'eval' command: The expression is malformed. An unexpected character is reached at '%)'.</msg></messages></response>$

Tags (2)
0 Karma

Re: REST API/Curl help


It would be useful if you put the curl line and XML response in a Code Sample block instead of the way you have here, but based on what is visible here, it looks like you're not escaping the double-quotes on the inside of the search string. That will almost certainly cause issues.

0 Karma

Re: REST API/Curl help

Ultra Champion

Try single quotes around the percentage sign or escape double quotes

eval FS_PercUsed=rtrim(Use,'%')


eval FS_PercUsed=rtrim(Use,\"%\")

View solution in original post