https://community.splunk.com/t5/Getting-Data-In/Splunk-Search-with-PIPE/m-p/529796#M89229 <P>So I have an application in centos that monitors process creation and sends it to a remote syslog server which is also running the Universal Forwarder. The syslog is then forwarded to Splunk and I split it using the pipe "|" delimiter. However, I found that many applications like awk and sed use "|" to filter which also messes up the field separation in splunk. Does anyone know how to work around this?</P><P>This is when I'm in search.</P><P>&nbsp;</P><P>&nbsp;</P><P>Thanks</P> Tue, 17 Nov 2020 17:27:29 GMT cj 2020-11-17T17:27:29Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Search-with-PIPE/m-p/529796#M89229 <P>So I have an application in centos that monitors process creation and sends it to a remote syslog server which is also running the Universal Forwarder. The syslog is then forwarded to Splunk and I split it using the pipe "|" delimiter. However, I found that many applications like awk and sed use "|" to filter which also messes up the field separation in splunk. Does anyone know how to work around this?</P><P>This is when I'm in search.</P><P>&nbsp;</P><P>&nbsp;</P><P>Thanks</P> Tue, 17 Nov 2020 17:27:29 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Search-with-PIPE/m-p/529796#M89229 cj 2020-11-17T17:27:29Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Search-with-PIPE/m-p/529808#M89231 <P>Depends on the context, but you may need to escape the pipe with a backslash \|</P> Tue, 17 Nov 2020 18:58:29 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Search-with-PIPE/m-p/529808#M89231 ITWhisperer 2020-11-17T18:58:29Z