I have the Authorization figured working, but every time I run a search, I get the following error: (NOTE the AAA/BBB/nnn stuff is just to mask actual values in this post) <messages> <msg type="DEBUG">Configuration initialization for /var/splunkhot/splunk/etc took 112ms when dispatching a search (search ID: 1556216662.24755_33CF52FC-F282-491A-875E-F8EC1EB01F4C)</msg> <msg type="DEBUG">Invalid eval expression for 'EVAL-url_length' in stanza [pan:threat]: The expression is malformed. Expected LIKE.</msg> <msg type="DEBUG">base lispy: [ AND host::AAAAAAA source::/app/jboss/BBBBBB/log/server.log ]</msg> <msg type="DEBUG">search context: user="nnnnnnn", app="search", bs-pathname="/var/splunkhot/splunk/etc"</msg> </messages> The actual search I have in the body of the POST is: search=search+host%3DAAAAAAA+source%3D%2Fapp%2Fjboss%2BBBBBB%2Flog%2Fserver.log+%7C+search+ERROR+earliest%3D-4h I've even done just a SIMPLE search: search=search+host%3DAAAAAAA and I STILL get an error. Any ideas what the issue is?? ... View more

I have the authorization done, and when I do the POST to do a search I keep getting the error: (note AAAA and bbb, nnnnnn are the correct host and logpath values in my actual search) <messages> <msg type="DEBUG">Configuration initialization for /var/splunkhot/splunk/etc took 143ms when dispatching a search (search ID: 1556216277.24597_33CF52FC-F282-491A-875E-F8EC1EB01F4C)</msg> <msg type="DEBUG">Invalid eval expression for 'EVAL-url_length' in stanza [pan:threat]: The expression is malformed. Expected LIKE.</msg> <msg type="DEBUG">base lispy: [ AND host::AAAAAAA source::/app/jboss/bbbb/log/server.log ]</msg> <msg type="DEBUG">search context: user="nnnnnnnn", app="search", bs-pathname="/var/splunkhot/splunk/etc"</msg> </messages> The actual search I have in the body is this ) search=search+host%3DAAAAAA+source%3D%2Fapp%2Fjboss%2Fbbbbb%2Flog%2Fserver.log+%7C+search+ERROR+earliest%3D-4h I've tried a bunch of different variations, but I am always getting th EVAL-url Length error. I even did JUST search=search+host%3DAAAAAA and still got the error! Any ideas here on how to format the search correctly to get this to run without that error? I can run the search directly in SPLUNK so it does in fact work. ... View more