Splunk Search

Why am I getting error "Comparator '=' is missing a term on the left hand side" using Java SDK setSearch method on JobResultsArgs?

Engager

I am trying to use setSearch method on JobResultsArgs object to apply post process search to results.
I am using Java SDK .
Here is code -
JobResultsArgs jobRes = new JobResultsArgs();

String search = "search=sampleserchstring";
jobRes.setSearch(search);
InputStream resultsNormalSearch = job.getResults(jobRes);

I get following error after running this -

<msg type="FATAL">Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the left hand side.</msg>

What is wrong here?
I initially had put String search = "sampleserchstring"; but that does not work either.

Thanks.

Tags (3)
0 Karma
1 Solution

Engager

I was making a mistake the search string should be something like -

String search = "search _raw=1234567";

View solution in original post

Engager

I was making a mistake the search string should be something like -

String search = "search _raw=1234567";

View solution in original post

Splunk Employee
Splunk Employee

Actually you probably want String search = "search samplesearchstring". You generally don't want to search _raw=xyz, because that will only match if the entire raw string is xyz.

The general point is that the first word of the search is the command you want, and then it's followed by the arguments. Most of the time you just want search, but it's possible to use others, such as metadata or inputlookup.

0 Karma