I have a simple script here that I intend to run periodically:

statsout=`docker stats --no-stream --format "{{json .}}"`
while read line ; do
        echo "$line"
        curl -k "https://splunkpath/services/collector" -H "Authorization: Splunk token" -d '{"index":"index", "sourcetype":"source:server", "source":"source:script:dev", "event":'$line'}'
done <<< "$statsout"

If I take the output from docker stats and manually type it in the event, it works beautifully, but if I try to parse it it fails miserably. Here is an example line:

{"BlockIO":"0B / 0B","CPUPerc":"4.27%","Container":"f49b9b6e8534","ID":"f49b9b6e8534","MemPerc":"1.07%","MemUsage":"342MiB / 31.24GiB","Name":"nginx","NetIO":"410MB / 208MB","PIDs":"11"}

I've tried all possible quoting combinations, checked 5-6 answers here and I have no idea what else to try. Any tips? I either get bad data format or bash starts pasting the lines as URL, even though there's nothing that would indicate that. (the echo line is just for me to see what it is doing).

Any tips?

Edit: If I place the variable between single quotes, I get

curl: (3) <url> malformed
curl: (6) Could not resolve host: 0B","CPUPerc":"0.22%","Container":"f014e518c912","ID":"f014e518c912","MemPerc":"0.03%","MemUsage"; Unknown error
curl: (3) <url> malformed
curl: (6) Could not resolve host: 31.24GiB","Name":"redis","NetIO"; Unknown error


curl -k "https://splunk-hec.intranet.mckinsey.com/services/collector" -H "Authorization: Splunk 5f1d28c8-a5be-48f6-9381-f9ed48deef78" -d '{"index":"converge_red_0", "sourcetype":"converge:server", "source":"converge:script:dev", "event":'"$line"'}'


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.