Search returns no result when including a ()

ToniHuynh — Tue, 01 Sep 2020 23:58:25 GMT

Hi everyone,

I have trouble to decode the token which contains some special character such as (). Below is my search and it does not return any result because the ObjectName contains the () in it:

index=wineventlog EventCode=4660 OR EventCode=4663 Account_Name!="ANONYMOUS LOGON" host="myServer" Account_Name!="*$" | eval ObjectName=urldecode("D:\Company Data\Employee\contract\Michael (Tim)\Induction\Example (D) - .msg") | eval ObjectName=replace(ObjectName,"\\\\","\\\\\\") | where match(Object_Name,ObjectName) | dedup _time host Account_Name Account_Domain Object_Name Accesses EventCodeDescription | timechart span=60m count(Object_Name) as Changes by Account_Name

If the ObjectName does not contain () then it will work well. Could anyone help me decode it?

Thanks,

Toni

Re: Search returns no result when including a ()

renjith_nair — Wed, 02 Sep 2020 04:09:57 GMT

Are you facing the issue in a dashboard token or in the search itself. Tried with the below sample search and it works fine and able to compare

|makeresults|eval ObjectName="D:\Company Data\Employee\contract\Michael (Tim)\Induction\Example (D) - .msg" |eval object_name="D:\Company Data\Employee\contract\Michael (Tim)\Induction\Example (D) - .msg" |eval status=if(ObjectName == object_name,"Equal","Not Equal")

Please let us know where exactly the search failing .

If Search with special characters also for the same issue, you may delete/close that post

topic Re: Search returns no result when including a () in Splunk Search

Search returns no result when including a ()

Re: Search returns no result when including a ()