Splunk Search

mismatch '[' in search

dgadjov
Explorer

Running this through the Splunk search I get no errors. However when I put this search in my Advance XML I get: mismatch '['

source="/usr/local/splunk/splunk_test/test_data/sample_data" _time=[ search source="/usr/local/splunk/splunk_test/test_data/sample_data" | stats latest(_time) as new_data | return $new_data] | table * | replace "Failed" with 0 "Passed" with 100 | appendpipe [stats avg(*) as *] | replace 0 with "Failed" 100 with "Passed"
Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

My guess is your "return $new_value]" got turned into "return " because there was no such variable to substitute. Try escaping the dollar sign with another dollar sign like this: "return $$new_value]"

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

My guess is your "return $new_value]" got turned into "return " because there was no such variable to substitute. Try escaping the dollar sign with another dollar sign like this: "return $$new_value]"

martin_mueller
SplunkTrust
SplunkTrust

$$ gets turned into $, much like \\ getting turned into \ in regular expressions. With a single dollar sign it's trying to substitute variables such as $foo$.

0 Karma

dgadjov
Explorer

Wow that works! What does the double dollar sign do to make this work?

0 Karma

vincesesto
Communicator

Hey dgagjov,

My guess would be that the characters in the search that you are doing are being recognized as xml tags and is confusing things. If you enclose your search in <![CDATA[ and ]]>, it will allow you to place anything into your search without there being any issue.

Eg:
<![CDATA[
source="/usr/local/splunk/splunk_test/test_data/sample_data" _time=[ search source="/usr/local/splunk/splunk_test/test_data/sample_data" | stats latest(_time) as new_data | return $new_data] | table * | replace "Failed" with 0 "Passed" with 100 | appendpipe [stats avg(*) as *] | replace 0 with "Failed" 100 with "Passed"
]]>

Let me know if you need me to elaborate, and let me know if this does not work.

Regards Vince

0 Karma

dgadjov
Explorer

This is actually the first thing that I tried when I got this error. With or without the CDATA the mismatch will occur.

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...