topic Re: Search for result with double quotes in Splunk Search

Search for result with double quotes

hendrkle — Tue, 03 Sep 2013 10:36:41 GMT

Hello,

I'm new to Splunk and am search for an event that would include this:

toState: "stateB",", fromState: "stateA"

Since the result has double quotes, if I use the above as a search, it will include a variety of events that I don't want to see because it doesn't take it as one string.

Any advice you could offer?

Re: Search for result with double quotes

apakhomov — Tue, 03 Sep 2013 12:13:18 GMT

Hello,
You can use backslashes for that. The search string is:

"toState: \"stateB\",\", fromState: \"stateA\""

Best regards,
Artem.

Re: Search for result with double quotes

apakhomov — Tue, 03 Sep 2013 12:39:41 GMT

However I would better suppose to extract the fields toState and formState. After extracting you will be able to use search string:
toState=stateB fromState=stateA

Re: Search for result with double quotes

hendrkle — Tue, 03 Sep 2013 14:32:06 GMT

Thanks Artem,

Using your suggestion, I get zero events back, even if I simply it like this:

"fromState: \"StateA\""

Any idead why this may be?

fromState is in a a huge string and I cannot use it as a field (I think).

Thanks

Re: Search for result with double quotes

apakhomov — Tue, 03 Sep 2013 14:51:16 GMT

Please, check the case of letters. StateA and stateA are different conditions for the system.

Re: Search for result with double quotes

rlshep — Tue, 05 Jun 2018 22:11:45 GMT

The search string should be

"toState: \"stateB\",\", fromState: \"stateA\""

Re: Search for result with double quotes

yuanliu — Thu, 24 Oct 2019 04:08:24 GMT

I downvoted this post because the correct syntax should have only one backslash escape.