topic Re: How to include double quotes in Switch Case in Splunk Search

How to include double quotes in Switch Case

Anantha123 — Tue, 03 Sep 2019 16:13:17 GMT

Hi All,

How can I do switch case for below values
{"XXX":["ABC"]} == ABC
{"XXX":[]} == NULL .

| eval Name=case(Name == "{"XXX":[]}", "NULL", Name == "{"XXX":["ABC"]}", "ABC" ) - This is not working.

Thanks in Advance.

tscroggins — Tue, 03 Sep 2019 16:17:04 GMT

Splunk uses C-style escape sequences in strings. Escape the inner quotation marks with a backslash:

| eval Name=case(Name == "{\"XXX\":[]}", "NULL", Name == "{\"XXX\":[\"ABC\"]}", "ABC" )

Anantha123 — Tue, 03 Sep 2019 16:19:12 GMT

Thank you. It works.