Splunk Search

Why am I getting error "Comparator '=' is missing a term on the left hand side" using Java SDK setSearch method on JobResultsArgs?

csp_splunk
Engager

I am trying to use setSearch method on JobResultsArgs object to apply post process search to results.
I am using Java SDK .
Here is code -
JobResultsArgs jobRes = new JobResultsArgs();

String search = "search=sampleserchstring";
jobRes.setSearch(search);
InputStream resultsNormalSearch = job.getResults(jobRes);

I get following error after running this -

<msg type="FATAL">Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the left hand side.</msg>

What is wrong here?
I initially had put String search = "sampleserchstring"; but that does not work either.

Thanks.

Tags (3)
0 Karma
1 Solution

csp_splunk
Engager

I was making a mistake the search string should be something like -

String search = "search _raw=1234567";

View solution in original post

csp_splunk
Engager

I was making a mistake the search string should be something like -

String search = "search _raw=1234567";

gkanapathy
Splunk Employee
Splunk Employee

Actually you probably want String search = "search samplesearchstring". You generally don't want to search _raw=xyz, because that will only match if the entire raw string is xyz.

The general point is that the first word of the search is the command you want, and then it's followed by the arguments. Most of the time you just want search, but it's possible to use others, such as metadata or inputlookup.

0 Karma
Get Updates on the Splunk Community!

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...