topic Re: How can I run a search if a field contains the "|" character? in Splunk Search

How can I run a search if a field contains the "|" character?

hsu88888 — Wed, 20 Sep 2017 18:19:58 GMT

Hello,

I need to count the event log line contains AAA|Y|42 but "|" is the pipeline command so that I got error as the following search:
I tried to use " double quote at two sides of the string but no return result.

index=transaction sourcetype=transaction_270 *AAA|Y|42*
| chart count by region_id, partner_id

Splunk will treat Y is the command and got this error:
Search Factory: Unknown search command 'y'.

Please help me with solution.

Thank you very much.

Re: How can I run a search if a field contains the "|" character?

somesoni2 — Wed, 20 Sep 2017 18:38:45 GMT

Just enclose *AAA|Y|42* in double quotes. It'll be then treated as string.

index=transaction sourcetype=transaction_270 "*AAA|Y|42*"
 | chart count by region_id, partner_id

Re: How can I run a search if a field contains the "|" character?

DalJeanis — Wed, 20 Sep 2017 19:02:05 GMT

This answer is correct and specific for that spot in a search, or for after the command | search. If it's inside a mapped search or a regex, use the rules for wherever it is (usually escape with \).

Re: How can I run a search if a field contains the "|" character?

lfedak_splunk — Thu, 21 Sep 2017 23:05:51 GMT

Hey @hsu88888, if DalJeanis and Somesoni2 solved your problem, please don't forget to accept the answer! You can upvote posts as well. (Karma points will be awarded for either action.) Happy Splunking!

Re: How can I run a search if a field contains the "|" character?

hsu88888 — Fri, 22 Sep 2017 01:11:21 GMT

No results found. I already said that in my question

Re: How can I run a search if a field contains the "|" character?

hsu88888 — Tue, 29 Sep 2020 15:57:33 GMT

No, double quote won't find any event.
This is the right solution that I use and work:
*AAA*Y*42*R

Re: How can I run a search if a field contains the "|" character?

hsu88888 — Tue, 29 Sep 2020 15:57:35 GMT

No, double quote won't find any event.
This is the right solution that I use and work:
*AAA*Y*42*R