Why using semicolon as multivalue delimiter results in "Unbalanced quotes" error when using the API?

[rjdefrancisco]

The following works fine in the Search app:

... | makemv delim=";" hashes | ...

The equivalent curl call

curl ... -d search="search ... | makemv delim=\";\" hashes | ..." -d output_mode=csv

fails with an "Unbalanced quotes" error. 

Delimiters other than ; work fine. I tried to escape the semicolon, use Unicode values, replace the string with a variable, all to no avail. Any suggestions?

[rjdefrancisco · Accepted solution]

I finally solved the problem by replacing the semicolon  with its URL encoding (%3b) inside the curl command:

curl ... -d search="search ... | makemv delim=\"%3b\" hashes | ..." -d output_mode=csv

[richgalloway]

How are you escaping the semicolon in the curl command?  I suspect you need to use a shell escape to keep the shell from thinking the ; separates two commands (and makes Splunk think the search is missing a quote).

curl ... -d search="search ... | makemv delim=\"~;\" hashes | ..." -d output_mode=csv