cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
gregnsk
Explorer
Member since: ‎12-23-2014
‎06-05-2020
Community Statistics
Posts 4
Solutions 0
Karma Given 1
Karma Received 3
Member Since ‎12-23-2014
Activity Feed
View All

Re: Why subsearch fails with error "Unable to pars...

by in Splunk Search
‎12-23-2014 03:16 PM
‎12-23-2014 03:16 PM
Thank you! This fixed the issue. I still wonder why multiple AND statements didn't work - but I have a solution now! ... View more

Re: Why subsearch fails with error "Unable to pars...

by in Splunk Search
‎12-23-2014 02:01 PM
‎12-23-2014 02:01 PM
thank you. if I add format statement to search #1 I get: ( ( User="viefhwd" AND endtime="12/09/2014:16:54:50" AND requestinghost="icsl2492" AND starttime="12/09/2014:16:45:37" ) ) And indeed if I use it as a search parameters for src=license I get an error: src=license User="viefhwd" AND requestinghost="icsl2492" AND starttime="12/09/2014:16:45:37" AND endtime="12/09/2014:16:54:50" Error in 'search' command: Unable to parse the search: Invalid search: AND AND. However, if I remove all AND statements from the above, everything works: src=license User="viefhwd" requestinghost="icsl2492" starttime="12/09/2014:16:45:37" endtime="12/09/2014:16:54:50" What's wrong with the statement with several ANDs? what would be the right way to fix it? ... View more

Re: Why subsearch fails with error "Unable to pars...

by in Splunk Search
‎12-23-2014 05:18 AM
‎12-23-2014 05:18 AM
I do this formatting to meet time format setting used at the second source. I have 2 sources: nbstatus and license. I want to get list of all events recorded from "license" input which happened on the same "requestinghost" for the same "user" and within the same "starttime-endtime" window as particular events in nbstatus source Search #1 returns nbstatus events I'm looking for. if I just apply it as a copy to "license" - I get what I need (item #4) But if I try to use it as a dynamic query, using subsearch - it fails (#2). If I loose the query (removing endtime) - this dynamic query works. ... View more

Why subsearch fails with error "Unable to parse th...

by in Splunk Search
‎12-23-2014 01:10 AM
3 Karma
‎12-23-2014 01:10 AM
3 Karma
search returns valid results, but fails with Invalid search: AND AND if defined as subsearch: 1. Search works ok: source=nbstatus requestinghost=icsl2492 User=viefhwd starttime="12/09/2014:16:44:40" endtime="12/09/2014:16:45:40" | convert timeformat="%m/%d/%Y %H:%M:%S" mktime(StartTime) AS stime | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(stime) AS starttime | convert timeformat="%m/%d/%Y %H:%M:%S" mktime(FinishTime) AS entime | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(entime) AS endtime |table requestinghost User starttime endtime requestinghost User starttime endtime icsl2492 viefhwd 12/09/2014:16:45:37 12/09/2014:16:54:50 2. If I define the above search as a subsearch to join with a different source, it fails: src=license [search source=nbstatus requestinghost=icsl2492 User=viefhwd starttime="12/09/2014:16:44:40" endtime="12/09/2014:16:45:40" | convert timeformat="%m/%d/%Y %H:%M:%S" mktime(StartTime) AS stime | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(stime) AS starttime | convert timeformat="%m/%d/%Y %H:%M:%S" mktime(FinishTime) AS entime | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(entime) AS endtime |table requestinghost User starttime endtime] Error in 'search' command: Unable to parse the search: Invalid search: AND AND. The search job has failed due to an error. You may be able view the job in the Job Inspector. 3. If I remove endtime only in the previous query – it works: src=license [search source=nbstatus requestinghost=icsl2492 User=viefhwd starttime="12/09/2014:16:44:40" endtime="12/09/2014:16:45:40" | convert timeformat="%m/%d/%Y %H:%M:%S" mktime(StartTime) AS stime | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(stime) AS starttime | convert timeformat="%m/%d/%Y %H:%M:%S" mktime(FinishTime) AS entime | convert timeformat="%m/%d/%Y:%H:%M:%S" ctime(entime) AS endtime |table requestinghost User starttime] 12,004 events (before 12/12/14 3:26:47.781 PM) 4. If I replace a subsearch from #2 with hard coded results of #1 I get the right results: src=license requestinghost=icsl2492 User=viefhwd starttime="12/09/2014:16:45:37" endtime="12/09/2014:16:54:50" | chart count by result result count DENIED 20 So what is wrong with my query #2? Thank you, Gregory ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from
View All
Karma given to
View All