mismatch '[' in search

[dgadjov]

Running this through the Splunk search I get no errors. However when I put this search in my Advance XML I get: mismatch '['

source="/usr/local/splunk/splunk_test/test_data/sample_data" _time=[ search source="/usr/local/splunk/splunk_test/test_data/sample_data" | stats latest(_time) as new_data | return $new_data] | table * | replace "Failed" with 0 "Passed" with 100 | appendpipe [stats avg(*) as *] | replace 0 with "Failed" 100 with "Passed"

[martin_mueller · Accepted solution]

My guess is your "return $new_value]" got turned into "return " because there was no such variable to substitute. Try escaping the dollar sign with another dollar sign like this: "return $$new_value]"

[martin_mueller]

$$ gets turned into $, much like \\ getting turned into \ in regular expressions. With a single dollar sign it's trying to substitute variables such as $foo$.

[dgadjov]

Wow that works! What does the double dollar sign do to make this work?

[vincesesto]

Hey dgagjov,

My guess would be that the characters in the search that you are doing are being recognized as xml tags and is confusing things. If you enclose your search in <![CDATA[ and ]]>, it will allow you to place anything into your search without there being any issue.

Eg:
<![CDATA[
source="/usr/local/splunk/splunk_test/test_data/sample_data" _time=[ search source="/usr/local/splunk/splunk_test/test_data/sample_data" | stats latest(_time) as new_data | return $new_data] | table * | replace "Failed" with 0 "Passed" with 100 | appendpipe [stats avg(*) as *] | replace 0 with "Failed" 100 with "Passed"
]]>

Let me know if you need me to elaborate, and let me know if this does not work.

Regards Vince

[dgadjov]

This is actually the first thing that I tried when I got this error. With or without the CDATA the mismatch will occur.