Splunk Search

Stats command error

yasit
Explorer

index=abcd | stats count(eval(searchmatch(''https://drive.google.com/uc?export=download&id=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X'))) as ''https://drive.google.com/uc?export=download&id=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X'  OR count(eval(searchmatch('value2')))  as 'value2'

I'm getting this error:

Error in 'stats' command: The argument '''https://drive.google.com/uc?export=download&id=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X'' is invalid.
 
 
this works fine with many other URLs and ips, is there any special character that is not allowed with stats?
Labels (6)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

Your quotes before the http appear to be two SINGLE quotes rather than a double quote. Once you fix that you get a different error about dynamic fields and it looks like it doesn't like the $ sign in the searchmatch string.

 

0 Karma

yasit
Explorer

what can be the solution here as I'm creating this query dynamically with format and giving as an input to base query. 
how can i escape these special charachters

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share your full search as the advice already given seems to fix the apparent errors in your example.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The string following "AS" should be a valid field name or a partial field name with a wildcard.  You can rename the field to something more verbose later in the query using rename.

---
If this reply helps you, Karma would be appreciated.
0 Karma

somesoni2
Revered Legend

The equal sign might be causing issues, escape them with backward slash. Also, the OR keyword between two stats fields is invalid, remove it.

index=abcd | stats count(eval(searchmatch("https://drive.google.com/uc?export\=download&id\=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X"))) as "https://drive.google.com/uc?export=download&id=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X"   count(eval(searchmatch("value2")))  as "value2"
0 Karma

yasit
Explorer

@somesoni2 still the stats command is raising the error while escaping the with \
error: The argument ''The argument ''https://abc.......?export\=download&id\=1HGFF5ziAFGn8161CKQC$Xyuhni9PNK_X'' is invalid."is invalid.

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...