Splunk Search

curl / python api fails on regex - scripted input

9738078959
Engager

When i run this in curl
curl index=text|rex field=_raw "ApplicationRegistry-(?.*)" max_match=0 |table source,sourcetype,text
it gives me an error, however if i remove the rex part, it works.
In python

import requests
data1 = {
  'search': 'search index=text|rex field=_raw "ApplicationRegistry-(?.*)" max_match=0 |table source,sourcetype,text',
  'output_mode': 'json'
}
response = requests.post('https://10.199.90.50:8089/servicesNS/admin/search/search/jobs/export', data=data1, verify=False, auth=('admin', 'admin'))

    f.write(response.text)

I get same issue - error if i use rex
I am on windows, how to run this through curl/.bat file or a python script?

0 Karma
1 Solution

Sukisen1981
Champion

this is very similar to the issue I faced here - https://answers.splunk.com/answers/744391/rex-expression-does-not-work-in-curl.html
in python its basically a windows UTF issue,can you append this code before you write your response, something like this?

    import requests
    data1 = {
      'search': 'search index=text|rex field=_raw "ApplicationRegistry-(?.*)" max_match=0 |table source,sourcetype,text',
      'output_mode': 'json'
    }
    response = requests.post('https://10.199.90.50:8089/servicesNS/admin/search/search/jobs/export', data=data1, verify=False, auth=('admin', 'admin'))
    with open ('<youroutputfile>.json', 'w', encoding="utf-8") as result:
        result.write(response.text)

Your rexes have got corrupted while pasting, I assume it works for you though.
NOTE - I am on windows10 and the OS version (earlier windows) might affect , but give this a try

View solution in original post

Sukisen1981
Champion

this is very similar to the issue I faced here - https://answers.splunk.com/answers/744391/rex-expression-does-not-work-in-curl.html
in python its basically a windows UTF issue,can you append this code before you write your response, something like this?

    import requests
    data1 = {
      'search': 'search index=text|rex field=_raw "ApplicationRegistry-(?.*)" max_match=0 |table source,sourcetype,text',
      'output_mode': 'json'
    }
    response = requests.post('https://10.199.90.50:8089/servicesNS/admin/search/search/jobs/export', data=data1, verify=False, auth=('admin', 'admin'))
    with open ('<youroutputfile>.json', 'w', encoding="utf-8") as result:
        result.write(response.text)

Your rexes have got corrupted while pasting, I assume it works for you though.
NOTE - I am on windows10 and the OS version (earlier windows) might affect , but give this a try

9738078959
Engager

hi the windows encoding utf8 is working as of now..i will check curl later

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...