topic Re: Table function is encoding my search results- how can I prevent this from happening? in Splunk Search

Table function is encoding my search results- how can I prevent this from happening?

Klaus_Mueller — Mon, 24 Apr 2023 17:32:50 GMT

My search is supposed to return some data with double quotes on it but when I use the TABLE function the results displayed are encoded.

Example:

Search:
index=* "america" "PurchaseOrgE"
|rex "Query being run \[(?<Query>(.*?)(?=\]))"
|eval ParsedQuery = replace(Query," AND "," AND ")
|table ParsedQuery

Expected result:
SELECT M2HTab1."SupplierKey.UniqueName" AS "SupplierKey_UniqueName",M2HTab1."Name"

Current result:

SELECT M2HTab1."SupplierKey.UniqueName" AS "SupplierKey_UniqueName",M2HTab1."Name"

As you can see in the examples the double quotes are encoded making it hard to properly see the results.

Is there a way to prevent this from happening?

Thanks in advance.

Re: Table function is encoding my search results- how can I prevent this from happening?

richgalloway — Mon, 24 Apr 2023 19:35:58 GMT

Have you tried the urldecode function?

index=* "america" "PurchaseOrgE" |rex "Query being run \[(?<Query>(.*?)(?=\]))" |eval ParsedQuery = urldecode(replace(Query," AND "," AND ")) |table ParsedQuery

Re: Table function is encoding my search results- how can I prevent this from happening?

Klaus_Mueller — Mon, 24 Apr 2023 20:00:40 GMT

Yes,

I did try it but looks like is not the replace function that is causing the data to be encoded and yes the table function.

Unfortunately, It also doesn't work.

Thanks for the reply.

Re: Table function is encoding my search results- how can I prevent this from happening?

PickleRick — Mon, 24 Apr 2023 20:34:03 GMT

Which version are you using and what do your events look like?

My tests don't show any form of conversion (either escaping or HTML encoding).

For example, this run-anywhere search

| makeresults 
| eval a="\"a quoted text with \" ' quotes \"" 
| table a

shows a perfectly good and expected output of

"a quoted text with " ' quotes "