https://community.splunk.com/t5/Splunk-Search/How-do-I-escape-the-in-Splunk-search-while-running-from-command/m-p/320782#M164572 <P>The single quote is being interpreted by curl as the breaker for your opening single quote for the <CODE>search</CODE>. Try escaping the single quote in <CODE>user's</CODE> with a backslash wrapped in single quotes. So it will look like this: <CODE>user'\''s</CODE></P> <P>If you cut and paste the search above, you're also missing a closing set of double quotes, btw. I expect your total command should look like this:</P> <P><CODE>curl -ku "user:password" <A href="https://myserver.com:8089/services/search/jobs/export" target="test_blank">https://myserver.com:8089/services/search/jobs/export</A> --data-urlencode search='search index=logs1 daysago=1 "user'\''s password changed"' -o splunkDataForLast24Hour.csv</CODE></P> Tue, 05 Dec 2017 21:05:43 GMT elliotproebstel 2017-12-05T21:05:43Z https://community.splunk.com/t5/Splunk-Search/How-do-I-escape-the-in-Splunk-search-while-running-from-command/m-p/320781#M164571 <P>Here is my query...</P> <P>curl -ku "user:password" <A href="https://myserver.com:8089/services/search/jobs/export">https://myserver.com:8089/services/search/jobs/export</A> --data-urlencode search='search index=logs1 daysago=1 "user's password changed' -o splunkDataForLast24Hour.csv</P> <P>Above query fails because of single quote in "user's" string, the query will work if I take out that quote but I want it to be there to find out the exact phrase.</P> <P>Even placing backslash did not help. Any inputs?</P> Tue, 05 Dec 2017 19:58:58 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-escape-the-in-Splunk-search-while-running-from-command/m-p/320781#M164571 chetanhonnavile 2017-12-05T19:58:58Z https://community.splunk.com/t5/Splunk-Search/How-do-I-escape-the-in-Splunk-search-while-running-from-command/m-p/320782#M164572 <P>The single quote is being interpreted by curl as the breaker for your opening single quote for the <CODE>search</CODE>. Try escaping the single quote in <CODE>user's</CODE> with a backslash wrapped in single quotes. So it will look like this: <CODE>user'\''s</CODE></P> <P>If you cut and paste the search above, you're also missing a closing set of double quotes, btw. I expect your total command should look like this:</P> <P><CODE>curl -ku "user:password" <A href="https://myserver.com:8089/services/search/jobs/export" target="test_blank">https://myserver.com:8089/services/search/jobs/export</A> --data-urlencode search='search index=logs1 daysago=1 "user'\''s password changed"' -o splunkDataForLast24Hour.csv</CODE></P> Tue, 05 Dec 2017 21:05:43 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-escape-the-in-Splunk-search-while-running-from-command/m-p/320782#M164572 elliotproebstel 2017-12-05T21:05:43Z https://community.splunk.com/t5/Splunk-Search/How-do-I-escape-the-in-Splunk-search-while-running-from-command/m-p/320783#M164573 <P>BTW, according to this post (<A href="https://stackoverflow.com/questions/32122586/curl-escape-single-quote">https://stackoverflow.com/questions/32122586/curl-escape-single-quote</A>) you might also have success if you change your single quotes around the <CODE>search</CODE> value to double-quotes and escape the double-quotes within the search using regular backlashes.</P> Tue, 05 Dec 2017 21:07:38 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-escape-the-in-Splunk-search-while-running-from-command/m-p/320783#M164573 elliotproebstel 2017-12-05T21:07:38Z https://community.splunk.com/t5/Splunk-Search/How-do-I-escape-the-in-Splunk-search-while-running-from-command/m-p/320784#M164574 <P>Just look for “password changed” instead...</P> Tue, 05 Dec 2017 23:34:46 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-escape-the-in-Splunk-search-while-running-from-command/m-p/320784#M164574 jkat54 2017-12-05T23:34:46Z