The following search is complaining about an unmatched parenthesis. Since the parentheses are inside of quotes, shouldn't the parser not care? Does anyone have a workaround?
{baseSearch}
| eval BaselineActual=replace(BaselineActual,") (",")<NEWLINE>(")
| makemv delim="<NEWLINE>" BaselineActual
Hi bruceclarke,
you need to escape the parentheses so Splunk will not use them:
| stats count | eval foo="This is ) ( my message" | eval BaselineActual=replace(foo,"\) \(",")<NEWLINE>(")
| makemv delim="<NEWLINE>" BaselineActual
or adapted to your search:
{baseSearch}
| eval BaselineActual=replace(BaselineActual,"\) \(",")<NEWLINE>(")
| makemv delim="<NEWLINE>" BaselineActual
Hope that helps ...
cheers, MuS
Hi bruceclarke,
you need to escape the parentheses so Splunk will not use them:
| stats count | eval foo="This is ) ( my message" | eval BaselineActual=replace(foo,"\) \(",")<NEWLINE>(")
| makemv delim="<NEWLINE>" BaselineActual
or adapted to your search:
{baseSearch}
| eval BaselineActual=replace(BaselineActual,"\) \(",")<NEWLINE>(")
| makemv delim="<NEWLINE>" BaselineActual
Hope that helps ...
cheers, MuS
Thanks MuS! I was actually playing around with this more and came to a similar conclusion. Ultimately this didn't work for me either.
Turns out that what I assumed was a space might actually be some other whitespace character. I was able to use the following to get it to work (note that "\s" matches any whitespace character):
{baseSearch}
| eval BaselineActual=replace(BaselineActual,")\s(",")
| makemv delim="