Splunk Search

Why am I getting error "Comparator '=' is missing a term on the left hand side" using Java SDK setSearch method on JobResultsArgs?

csp_splunk
Engager

I am trying to use setSearch method on JobResultsArgs object to apply post process search to results.
I am using Java SDK .
Here is code -
JobResultsArgs jobRes = new JobResultsArgs();

String search = "search=sampleserchstring";
jobRes.setSearch(search);
InputStream resultsNormalSearch = job.getResults(jobRes);

I get following error after running this -

<msg type="FATAL">Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the left hand side.</msg>

What is wrong here?
I initially had put String search = "sampleserchstring"; but that does not work either.

Thanks.

Tags (3)
0 Karma
1 Solution

csp_splunk
Engager

I was making a mistake the search string should be something like -

String search = "search _raw=1234567";

View solution in original post

csp_splunk
Engager

I was making a mistake the search string should be something like -

String search = "search _raw=1234567";

gkanapathy
Splunk Employee
Splunk Employee

Actually you probably want String search = "search samplesearchstring". You generally don't want to search _raw=xyz, because that will only match if the entire raw string is xyz.

The general point is that the first word of the search is the command you want, and then it's followed by the arguments. Most of the time you just want search, but it's possible to use others, such as metadata or inputlookup.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...