Splunk Search

Why does my drilldown with the rex command return an "Unbalanced quotes" error?

damucka
Builder

Hello,

I have the following drilldown in my dashboard panel:

          <link target="_blank"><![CDATA[search?q=index=mlbso sourcetype=$SYSID$_hanatraces earliest=$earliesttime$ latest=$latesttime$ [search index=mlbso sourcetype=$SYSID$_hanatraces  "ALTER SYSTEM ALTER CONFIGURATION" earliest=$earliesttime$ latest=$latesttime$ | rex field=_raw "(?i)(?<=configuration is changed by )(?P<CONNECTION_ID>(?s)(.*))(?=, client ip)" | return $CONNECTION_ID]]]></link>

When I execute it, I get the following search string presented and an "Unbalanced quotes" error:

index=mlbso sourcetype=BWP_hanatraces earliest=1543313122.531 latest=1543313122.537 [search index=mlbso sourcetype=BWP_hanatraces  "ALTER SYSTEM ALTER CONFIGURATION" earliest=1543313122.531 latest=1543313122.537 | rex field=_raw "(

How would I overcome this issue?

Kind Regards,

Kamil

0 Karma
1 Solution

MathiasLindblom
Path Finder

Hi, seems like the question mark is messing things up, replace all the question marks with %3F:

<link target="_blank">    <![CDATA[search?q=index=mlbso sourcetype=$SYSID$_hanatraces earliest=$earliesttime$ latest=$latesttime$ [search index=mlbso sourcetype=$SYSID$_hanatraces  "ALTER SYSTEM ALTER CONFIGURATION" earliest=$earliesttime$ latest=$latesttime$ | rex field=_raw "(%3Fi)(%3F<=configuration is changed by )(%3FP<CONNECTION_ID>(%3Fs)(.*))(%3F=, client ip)" | return $CONNECTION_ID]]]></link>

View solution in original post

MathiasLindblom
Path Finder

Hi, seems like the question mark is messing things up, replace all the question marks with %3F:

<link target="_blank">    <![CDATA[search?q=index=mlbso sourcetype=$SYSID$_hanatraces earliest=$earliesttime$ latest=$latesttime$ [search index=mlbso sourcetype=$SYSID$_hanatraces  "ALTER SYSTEM ALTER CONFIGURATION" earliest=$earliesttime$ latest=$latesttime$ | rex field=_raw "(%3Fi)(%3F<=configuration is changed by )(%3FP<CONNECTION_ID>(%3Fs)(.*))(%3F=, client ip)" | return $CONNECTION_ID]]]></link>

damucka
Builder

Thank you, it works.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...