topic Re: HTTP Event Collector: Why are double quotes not escaped for a properly formatted JSON string? in Getting Data In

HTTP Event Collector: Why are double quotes not escaped for a properly formatted JSON string?

unclethan — Mon, 04 Apr 2016 23:33:18 GMT

A properly formatted JSON string will escape the double quotes. However the HEC does not translate that accordingly.

e.g JSON message to HEC: {"event":"somefield=\"a value with spaces\""}
the value for somefield is \"a value with spaces\"
when it should have the value a value with spaces

Any information on how to rectify this would be appreciated.

Re: HTTP Event Collector: Why are double quotes not escaped for a properly formatted JSON string?

gblock_splunk — Tue, 05 Apr 2016 04:30:09 GMT

This is fixed in the next version of Splunk, 6.4 which will be shipping very soon.

Re: HTTP Event Collector: Why are double quotes not escaped for a properly formatted JSON string?

IdoTwiggle — Tue, 18 Oct 2016 11:41:50 GMT

Hi,

We're currently using Splunk version 6.4.1 and still experiencing this bug.
Can you verify if / on what version was it fixed to let us know what version should we upgrade to?

Thanks,
Ido