topic Re: Filter for messages that contains text with quotation marks in Splunk Search

Filter for messages that contains text with quotation marks

raculim — Fri, 27 Sep 2024 19:33:23 GMT

Hi,

I'm having a hard time trying to narrow down my search results.

I would like to return only the results that contain the following string on the message: "progress":"COMPLETED","subtopics":"COMPLETED"

The text must be all together, in the sequence above.

I tried to add a string like the one below in my search but it didn't work:

message="*\"progress\":\"COMPLETED\",\"subtopics\":\"COMPLETED\"*"

Does anyone have suggestions on how to do that?

I appreciate any help you can provide.

Re: Filter for messages that contains text with quotation marks

PickleRick — Fri, 27 Sep 2024 19:55:35 GMT

Seems to work for me.

9.3.0

Re: Filter for messages that contains text with quotation marks

raculim — Fri, 27 Sep 2024 21:21:35 GMT

Hi @PickleRick

First of all, thanks for the reply.

Let me try to give you a more concrete example:

1. One search example that returns a single result (this works as expected)

2. Adding the TOPIC_COMPLETION string to the search (this works as expected)

3. Adding the "TOPIC_COMPLETION" string to the search (this doesn't return any results. I was expecting the same results as in 1 and 2)

Version 9.2.2406.107

Re: Filter for messages that contains text with quotation marks

PickleRick — Fri, 27 Sep 2024 22:23:20 GMT

Try enclosing your search term with quotes.

"\"TOPIC_COMPLETION\""

Re: Filter for messages that contains text with quotation marks

inventsekar — Sat, 28 Sep 2024 07:07:35 GMT

Hi @raculim .. @PickleRick 's suggestion works fine, tested (9.3.0)

Re: Filter for messages that contains text with quotation marks

isoutamo — Sat, 28 Sep 2024 10:39:14 GMT

one thing what you should do is to check how events are in raw data. Probably the easiest way is check it via "Event Actions -> Show Source".

In that way you will see how it really is. After that you know (especially with json) are there any space or other character which you need to take care on your strings.

r. Ismo

Re: Filter for messages that contains text with quotation marks

raculim — Mon, 30 Sep 2024 11:53:33 GMT

Thanks @isoutamo .

The raw data contains some backslashes already:

\"TOPIC_COMPLETION\"

So I had to perform my seach like this:

index="..." "08:29:41.630" AND \\\"TOPIC_COMPLETION\\\"

Now it's working properly.