Splunk Search

Why am I getting error "Comparator '=' is missing a term on the left hand side" using Java SDK setSearch method on JobResultsArgs?

csp_splunk
Engager

I am trying to use setSearch method on JobResultsArgs object to apply post process search to results.
I am using Java SDK .
Here is code -
JobResultsArgs jobRes = new JobResultsArgs();

String search = "search=sampleserchstring";
jobRes.setSearch(search);
InputStream resultsNormalSearch = job.getResults(jobRes);

I get following error after running this -

<msg type="FATAL">Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the left hand side.</msg>

What is wrong here?
I initially had put String search = "sampleserchstring"; but that does not work either.

Thanks.

Tags (3)
0 Karma
1 Solution

csp_splunk
Engager

I was making a mistake the search string should be something like -

String search = "search _raw=1234567";

View solution in original post

csp_splunk
Engager

I was making a mistake the search string should be something like -

String search = "search _raw=1234567";

gkanapathy
Splunk Employee
Splunk Employee

Actually you probably want String search = "search samplesearchstring". You generally don't want to search _raw=xyz, because that will only match if the entire raw string is xyz.

The general point is that the first word of the search is the command you want, and then it's followed by the arguments. Most of the time you just want search, but it's possible to use others, such as metadata or inputlookup.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...