topic Re: Escaping a forward slash / in conditional statement in Splunk Search

Escaping a forward slash / in conditional statement

mstark31 — Tue, 10 Oct 2017 19:16:25 GMT

I have a conditional statement (part of an eval case) in which I need to check for the value of a field. The desired value contains a forward slash ( /).
| eval Bool = case(Reason=="Thing1 / Thing2", 0, ... 1=1, 1). This statement will evaluate to Bool = 1.

I've tried to escape it with a back slash ( /), but that didn't work.
| eval Bool = case(Reason=="Thing1 \/ Thing2", 0, ... 1=1, 1). This still evaluates to Bool = 1.

I can technically use a like statement, which is how I know the / is causing the issue.
| eval Bool = case(Reason like "Thing1 % Thing2", 0, ... 1=1, 1). This evaluates to Bool = 0.
| eval Bool = case(Reason like "Thing1%Thing2", 0, ... 1=1, 1). This evaluates to Bool = 0. (The only difference is no spaces around the % character.)

Is there a solution that will let me use an exact match search vs. the like statement?

Re: Escaping a forward slash / in conditional statement

MuS — Tue, 10 Oct 2017 19:26:38 GMT

Hi mstark31,

What version are you on? Because this works just fine on 6.6.3 using this search:

| makeresults 
| eval Reason="Thing1 / Thing2" 
| eval Bool = case(Reason=="Thing1 / Thing2", 0, 1=1, 1) 
| eval Bool2 = case(Reason=="Thing2 / Thing2", 0, 1=1, 1)

cheers, MuS

Re: Escaping a forward slash / in conditional statement

s2_splunk — Tue, 10 Oct 2017 19:28:00 GMT

You should not need to escape anything other than a double quote within a string. Are you sure your Reason field contains exactly the string value you are evaluating in your case statement (extra spaces, tab characters, etc.)?

Re: Escaping a forward slash / in conditional statement

sbbadri — Tue, 10 Oct 2017 19:28:38 GMT

@mstark31

check this,

| makeresults | eval test="Thing1 / Thing2" | eval test1 = case(test=="Thing1 / Thing2","One",test!="Thing1 / Thing2","Two") | eval test2 = case(test="Thing1 \/ Thing2","one",test!="Thing1 \/ Thing2","TWO")

Re: Escaping a forward slash / in conditional statement

mstark31 — Tue, 10 Oct 2017 20:29:33 GMT

I am in 6.6.2.

I tried your search, and it does exactly what yours does (basically, works).

I had to abstract things for the search I shared in my question, but my original search still doesn't function properly. I am in the process of making sure I'm not missing anything else.

Re: Escaping a forward slash / in conditional statement

mstark31 — Tue, 10 Oct 2017 20:39:04 GMT

Thank you for helping with my debugging process. Despite the fact that I was copying and pasting the value for Reason from my data table, there was another space in there causing the problem. I went back to our original database that is sending to Splunk and found the space.

I feel silly, but at least I was able to rule out the need to escape the forward /.

Re: Escaping a forward slash / in conditional statement

s2_splunk — Tue, 10 Oct 2017 20:46:52 GMT

He/She who has never overlooked a space throw the first rock! 😉
Glad you got it figured out; and thanks for closing the loop by providing (re)solution and accepting answer!