Unmatched parentheses error with replace

[bruceclarke]

The following search is complaining about an unmatched parenthesis. Since the parentheses are inside of quotes, shouldn't the parser not care? Does anyone have a workaround?

{baseSearch}
| eval BaselineActual=replace(BaselineActual,") (",")<NEWLINE>(")
| makemv delim="<NEWLINE>" BaselineActual 

[MuS · Accepted solution]

Hi bruceclarke,

you need to escape the parentheses so Splunk will not use them:

 | stats count | eval foo="This is ) ( my message" | eval BaselineActual=replace(foo,"\) \(",")<NEWLINE>(")
 | makemv delim="<NEWLINE>" BaselineActual

or adapted to your search:

 {baseSearch}
 | eval BaselineActual=replace(BaselineActual,"\) \(",")<NEWLINE>(")
 | makemv delim="<NEWLINE>" BaselineActual 

Hope that helps ...

cheers, MuS

[bruceclarke]

Thanks MuS! I was actually playing around with this more and came to a similar conclusion. Ultimately this didn't work for me either.

Turns out that what I assumed was a space might actually be some other whitespace character. I was able to use the following to get it to work (note that "\s" matches any whitespace character):
{baseSearch}
| eval BaselineActual=replace(BaselineActual,")\s(",")(")
| makemv delim="" BaselineActual