topic Re: Use quoted parameter in request in Splunk Search https://community.splunk.com/t5/Splunk-Search/Use-quoted-parameter-in-request/m-p/117628#M183996 <P>You can try this:</P> <P><CODE>your_search | extract kvdelim=":" | search Version="21"</CODE></P> <P>This will pull the Key Value pairs that are delimited by a colon ":".</P> Mon, 28 Oct 2013 11:11:02 GMT alacercogitatus 2013-10-28T11:11:02Z Use quoted parameter in request https://community.splunk.com/t5/Splunk-Search/Use-quoted-parameter-in-request/m-p/117627#M183995 <P>I have quoted parameters in log files, which are processed by Splunk:</P> <PRE><CODE>"Version":"21" </CODE></PRE> <P>How to extract that parameter to use in requests like this:</P> <PRE><CODE>Version = "21" OR ... </CODE></PRE> <P>Please note that it's no chance to modify current Splunk's config files.</P> <P>(original question: stackoverflow #18897765)</P> Mon, 28 Oct 2013 10:26:52 GMT https://community.splunk.com/t5/Splunk-Search/Use-quoted-parameter-in-request/m-p/117627#M183995 MaximKorobov 2013-10-28T10:26:52Z Re: Use quoted parameter in request https://community.splunk.com/t5/Splunk-Search/Use-quoted-parameter-in-request/m-p/117628#M183996 <P>You can try this:</P> <P><CODE>your_search | extract kvdelim=":" | search Version="21"</CODE></P> <P>This will pull the Key Value pairs that are delimited by a colon ":".</P> Mon, 28 Oct 2013 11:11:02 GMT https://community.splunk.com/t5/Splunk-Search/Use-quoted-parameter-in-request/m-p/117628#M183996 alacercogitatus 2013-10-28T11:11:02Z Re: Use quoted parameter in request https://community.splunk.com/t5/Splunk-Search/Use-quoted-parameter-in-request/m-p/117629#M183997 <P>I tryed it with no luck. Example: <CODE>"Model":"Lenovo K900_ROW","Android":"4.2.1","Date":"Mon Sep 30 23:58:27 GMT+03:00 2013","Build":"RC11","LastActivity":"ru.TextActivity","Version":"21""StackTrace":"java.lang.RuntimeException"...</CODE> wasn't found.</P> Mon, 28 Oct 2013 11:47:32 GMT https://community.splunk.com/t5/Splunk-Search/Use-quoted-parameter-in-request/m-p/117629#M183997 MaximKorobov 2013-10-28T11:47:32Z Re: Use quoted parameter in request https://community.splunk.com/t5/Splunk-Search/Use-quoted-parameter-in-request/m-p/117630#M183998 <P><CODE>|extract kvdelim=":" pairdelim=","</CODE></P> Mon, 28 Oct 2013 13:37:33 GMT https://community.splunk.com/t5/Splunk-Search/Use-quoted-parameter-in-request/m-p/117630#M183998 alacercogitatus 2013-10-28T13:37:33Z