topic Re: escaping hyphen if any field has hyphen(-) as value in Splunk Search

escaping hyphen if any field has hyphen(-) as value

thambisetty — Thu, 19 Jun 2014 15:49:56 GMT

Hi
I have data like below in the Active Directory.

Account Name

-
L-15485
D-5486
BLR-DC-09$

Here is my query;
| search "Account Name"="-"

showing Output:

BLR-DC-09$

but actual output to be expected:

L-15485
D-5486
BLR-DC-09$

Note: I read splunk document for -(hyphen) it says - for match any character.
Now my question is how to escape that one as it works.

Re: escaping hyphen if any field has hyphen(-) as value

yannK — Thu, 19 Jun 2014 15:53:20 GMT

have you tried :

| search "Account Name"="*-*"

Re: escaping hyphen if any field has hyphen(-) as value

somesoni2 — Thu, 19 Jun 2014 15:56:41 GMT

Try | search "Account Name"="*"

Re: escaping hyphen if any field has hyphen(-) as value

thambisetty — Thu, 19 Jun 2014 15:57:36 GMT

for hyphen?

Re: escaping hyphen if any field has hyphen(-) as value

thambisetty — Thu, 19 Jun 2014 16:22:51 GMT

I tried that one by that also im getting only BLR-DC-09$
I want to remove only - values from that field.
your query is wrong..

Re: escaping hyphen if any field has hyphen(-) as value

aweitzman — Thu, 19 Jun 2014 17:07:26 GMT

I'm not sure where you read that hyphen matches any character in Splunk. Could you please provide a link to where it says that? I can't think of a circumstance where it does, especially inside quotes.

I don't think I understand what you mean by "escape." Are you trying to write a search that returns all rows except the ones where the Account Name field has just a hyphen in it? And if so, does:

"Account Name"!="-"

not work? If not, how about:

"Account Name"!="\-"

What does that get you?

Re: escaping hyphen if any field has hyphen(-) as value

linu1988 — Thu, 19 Jun 2014 17:16:45 GMT

Hello,
you need the where clause.

...|where "Account Name" like "%-%-%"

Thanks,
L

Re: escaping hyphen if any field has hyphen(-) as value

ewelch_splunk — Tue, 11 Dec 2018 16:19:56 GMT

My use case was a little different, I was trying to remove Account_Name = "-" from sourcetype = ActiveDirectory, and the where clause was the only method that I could find that produced the results I needed. Thanks!