newlines in stats command failure with savedsearch

[sloshburch]

I've discovered that if you have newlines in a stats command in a savedsearch like this:

| stats values(blah),
  list(otherblah)
 by field

running that | savedsearch <searchname> will throw an error such as this:

{'fatal': ["Error in 'stats' command: The argument '\n' is invalid."],

We use spacing and newlines to make savedsearches easier to read across large teams. There are no issues using them through the UI, but it appears that calling them with savedsearch or curl throws this error.

It seems like a bug but I figured I'd check with the expert community first. I'm curious if anyone has seen this before or knows if its by design?

[sloshburch · Accepted solution]

I opened a suppoort case and learned that this is bugs SPL-81061 and SPL-80985 and fixed in 6.0.4. http://docs.splunk.com/Documentation/Splunk/6.0.4/ReleaseNotes/6.0.4#Search.2C_saved_search.2C_alert...