Splunk Search

mismatch '[' in search

dgadjov
Explorer

Running this through the Splunk search I get no errors. However when I put this search in my Advance XML I get: mismatch '['

source="/usr/local/splunk/splunk_test/test_data/sample_data" _time=[ search source="/usr/local/splunk/splunk_test/test_data/sample_data" | stats latest(_time) as new_data | return $new_data] | table * | replace "Failed" with 0 "Passed" with 100 | appendpipe [stats avg(*) as *] | replace 0 with "Failed" 100 with "Passed"
Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

My guess is your "return $new_value]" got turned into "return " because there was no such variable to substitute. Try escaping the dollar sign with another dollar sign like this: "return $$new_value]"

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

My guess is your "return $new_value]" got turned into "return " because there was no such variable to substitute. Try escaping the dollar sign with another dollar sign like this: "return $$new_value]"

martin_mueller
SplunkTrust
SplunkTrust

$$ gets turned into $, much like \\ getting turned into \ in regular expressions. With a single dollar sign it's trying to substitute variables such as $foo$.

0 Karma

dgadjov
Explorer

Wow that works! What does the double dollar sign do to make this work?

0 Karma

vincesesto
Communicator

Hey dgagjov,

My guess would be that the characters in the search that you are doing are being recognized as xml tags and is confusing things. If you enclose your search in <![CDATA[ and ]]>, it will allow you to place anything into your search without there being any issue.

Eg:
<![CDATA[
source="/usr/local/splunk/splunk_test/test_data/sample_data" _time=[ search source="/usr/local/splunk/splunk_test/test_data/sample_data" | stats latest(_time) as new_data | return $new_data] | table * | replace "Failed" with 0 "Passed" with 100 | appendpipe [stats avg(*) as *] | replace 0 with "Failed" 100 with "Passed"
]]>

Let me know if you need me to elaborate, and let me know if this does not work.

Regards Vince

0 Karma

dgadjov
Explorer

This is actually the first thing that I tried when I got this error. With or without the CDATA the mismatch will occur.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...