I seem to be having the same problem. Looks like there is something wrong with the command ... View more

Just had the very same problem and spent far too long trying to solve it. If you write test like this: $test$ then splunk interprets this as expecting an input variable of test. To resolve this it looks like you have to use double dollar signs: | makeresults count=1 | eval test="Hello" | map search="| makeresults count=1 | eval test=$$test$$" ... View more

I have just been dealing with the same issue after upgrading Splunk to version 7.01. I found the issue was resolved by simply upgrading the oracle database driver. I was using the old driver ojdbc6.jar, and after upgrading this to ojdbc7.jar everything worked fine again. For instructions on how to install a new database driver and links to download the drivers see the below documentation page: http://docs.splunk.com/Documentation/DBX/3.1.1/DeployDBX/Installdatabasedrivers ,I have just been dealing with the same problem after upgrading to Splunk 7.01. I found it was caused by the fact that I had the Oracle driver ojdbc6.jar. Once I updated this to ojdbc7.jar everything started working again. Instructions for installing a new driver and links to where they can be downloaded can be found here: http://docs.splunk.com/Documentation/DBX/3.1.1/DeployDBX/Installdatabasedrivers ... View more